theory Ipc_C

lemma receiveSignal_ccorres [corres]:
  "ccorres dc xfdc (invs' and valid_cap' cap and st_tcb_at' simple' thread
                    and sch_act_not thread
                    and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))
                    and K (isNotificationCap cap))
     (UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>
           \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace>
           \<inter> {s. isBlocking_' s = from_bool is_blocking}) hs
     (receiveSignal thread cap is_blocking)
     (Call receiveSignal_'proc)" unfolding K_def supply if_cong[cong] option.case_cong[cong] apply (rule ccorres_gen_asm) apply (cinit lift: thread_' cap_' isBlocking_') apply (rule ccorres_pre_getNotification, rename_tac ntfn) apply (rule_tac xf'=ret__unsigned_'
               and val="capNtfnPtr cap"
               and R=\<top>
                in ccorres_symb_exec_r_known_rv_UNIV[where R'=UNIV]) apply vcg apply (clarsimp simp: cap_get_tag_isCap isCap_simps) apply (frule cap_get_tag_isCap_unfolded_H_cap) apply (simp add: cap_notification_cap_lift ccap_relation_def cap_to_H_def) apply ceqv apply csymbr apply (rule_tac xf'=ret__unsigned_'
                and val="case ntfnObj ntfn of IdleNtfn \<Rightarrow> scast NtfnState_Idle
                                  | WaitingNtfn _ \<Rightarrow> scast NtfnState_Waiting
                                  | ActiveNtfn _ \<Rightarrow> scast NtfnState_Active"
                and R="ko_at' ntfn (capNtfnPtr cap)"
                 in ccorres_symb_exec_r_known_rv_UNIV[where R'=UNIV]) apply (vcg, clarsimp) apply (erule(1) cmap_relation_ko_atE [OF cmap_relation_ntfn]) apply (clarsimp simp: cnotification_relation_def Let_def typ_heap_simps
                      split: Structures_H.ntfn.splits) apply ceqv apply wpc
       \<comment> \<open>IdleNtfn case\<close> apply (rule ccorres_cond_true) apply csymbr apply (simp only: case_bool_If from_bool_neq_0) apply (rule ccorres_Cond_rhs, simp cong: Collect_cong) apply (intro ccorres_rhs_assoc) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_split_nothrow_novcg) apply (rule receiveSignal_block_ccorres_helper[simplified]) apply ceqv apply (simp only: K_bind_def) apply (rule receiveSignal_enqueue_ccorres_helper[simplified]) apply (simp add: valid_ntfn'_def) apply (wp sts_st_tcb') apply (rule_tac Q="\<lambda>rv. ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn
                               \<and> projectKO_opt x = (None::tcb option))
                                  (capNtfnPtr cap)"
                       in hoare_post_imp) apply (clarsimp simp: obj_at'_def ko_wp_at'_def projectKOs) apply wp apply (clarsimp simp: guard_is_UNIV_def) apply simp apply (ctac add: doNBRecvFailedTransfer_ccorres)
      \<comment> \<open>ActiveNtfn case\<close> apply (rename_tac badge) apply (rule ccorres_cond_false) apply (rule ccorres_cond_true) apply (intro ccorres_rhs_assoc) apply (rule_tac val=badge
                  and xf'=ret__unsigned_'
                  and R="ko_at' ntfn (capNtfnPtr cap)"
                   in ccorres_symb_exec_r_known_rv_UNIV [where R'=UNIV]) apply (vcg, clarsimp) apply (erule(1) cmap_relation_ko_atE [OF cmap_relation_ntfn]) apply (clarsimp simp: cnotification_relation_def Let_def typ_heap_simps
                        split: Structures_H.notification.splits) apply ceqv apply (clarsimp simp: badgeRegister_def Kernel_C.badgeRegister_def, ctac(no_vcg)) apply (rule_tac P="invs' and ko_at' ntfn (capNtfnPtr cap)"
                    and P'=UNIV
                     in ccorres_from_vcg) apply (rule allI, rule conseqPre, vcg) apply clarsimp apply (frule(1) cmap_relation_ko_atD [OF cmap_relation_ntfn]) apply (clarsimp simp: typ_heap_simps setNotification_def) apply (rule bexI [OF _ setObject_eq]) apply (simp add: rf_sr_def cstate_relation_def Let_def
                             cpspace_relation_def update_ntfn_map_tos
                             typ_heap_simps') apply (elim conjE) apply (intro conjI) apply (rule cpspace_relation_ntfn_update_ntfn, assumption+) apply (simp add: cnotification_relation_def Let_def
                                NtfnState_Idle_def mask_def) apply simp apply (simp add: carch_state_relation_def typ_heap_simps') apply (simp add: cmachine_state_relation_def) apply (simp add: h_t_valid_clift_Some_iff) apply (simp add: objBits_simps') apply (simp add: objBits_simps) apply assumption apply wp apply (clarsimp simp: guard_is_UNIV_def) apply (clarsimp simp: ARM.badgeRegister_def Kernel_C.R0_def)
     \<comment> \<open>WaitingNtfn case\<close> apply (rename_tac list) apply (rule ccorres_cond_true) apply csymbr apply (simp only: case_bool_If from_bool_neq_0) apply (rule ccorres_Cond_rhs, simp cong: Collect_cong) apply (intro ccorres_rhs_assoc) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_split_nothrow_novcg) apply (simp only: ) apply (rule receiveSignal_block_ccorres_helper[simplified]) apply ceqv apply (simp only: K_bind_def) apply (rule_tac ntfn="ntfn" in receiveSignal_enqueue_ccorres_helper[simplified]) apply (simp add: valid_ntfn'_def) apply (wp sts_st_tcb') apply (rule_tac Q="\<lambda>rv. ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn
                             \<and> projectKO_opt x = (None::tcb option))
                                    (capNtfnPtr cap)
                      and K (thread \<notin> set list)"
                       in hoare_post_imp) apply (clarsimp simp: obj_at'_def ko_wp_at'_def projectKOs) apply wp apply (clarsimp simp: guard_is_UNIV_def) apply simp apply (ctac add: doNBRecvFailedTransfer_ccorres) apply (clarsimp simp: guard_is_UNIV_def NtfnState_Active_def
                          NtfnState_Waiting_def NtfnState_Idle_def) apply (clarsimp simp: guard_is_UNIV_def) apply (clarsimp split: if_split) apply (rule conjI) apply (clarsimp dest!: st_tcb_strg'[rule_format]
                    simp: isNotificationCap_def valid_cap'_def obj_at'_def projectKOs
                   split: capability.splits split del: if_split) apply clarsimp apply (frule(1) ko_at_valid_objs' [OF _ invs_valid_objs']) apply (clarsimp simp: projectKO_opt_ntfn split: kernel_object.split_asm) apply (subgoal_tac "state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}") apply (clarsimp simp: valid_obj'_def valid_ntfn'_def refs_of'_def
                  split: ntfn.splits) apply (subgoal_tac "state_refs_of' s (capNtfnPtr cap) =
                             {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound}") subgoal by (fastforce simp: obj_at'_def is_aligned_neg_mask objBits_simps'
                           projectKOs invs'_def valid_state'_def st_tcb_at'_def
                           valid_tcb_state'_def ko_wp_at'_def
                           isBlockedOnNotification_def projectKO_opt_tcb
                     elim: delta_sym_refs
                    split: if_split_asm if_split) apply (auto simp: obj_at'_def state_refs_of'_def projectKOs ntfn_bound_refs'_def)[1] apply (rename_tac list) apply (subgoal_tac "state_refs_of' s (capNtfnPtr cap) = (set list) \<times> {NTFNSignal}
                                       \<union> {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound}
                              \<and> thread \<notin> (set list)") subgoal by (fastforce simp: obj_at'_def is_aligned_neg_mask objBits_simps'
                          projectKOs invs'_def valid_state'_def st_tcb_at'_def
                          valid_tcb_state'_def ko_wp_at'_def
                          isBlockedOnNotification_def projectKO_opt_tcb
                    elim: delta_sym_refs
                   split: if_split_asm if_split) apply (frule(1) sym_refs_obj_atD' [OF _ invs_sym']) apply (rule conjI, clarsimp simp: ko_wp_at'_def dest!: ntfnBound_state_refs_equivalence) apply (clarsimp simp: st_tcb_at'_def ko_wp_at'_def obj_at'_def projectKOs
                  split: if_split_asm) apply (drule(1) bspec)+ apply (drule_tac x="(thread, NTFNSignal)" in bspec, clarsimp) apply (clarsimp simp: tcb_bound_refs'_def) apply (case_tac "tcbState obj", simp_all)[1] apply (frule(1) st_tcb_idle' [OF invs_valid_idle'], simp) apply (clarsimp simp: st_tcb_at'_def obj_at'_def state_refs_of'_def projectKOs
                 split: if_split_asm) apply (case_tac "tcbState obj", clarsimp+)[1] done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap cap)) (UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool is_blocking\<rbrace>) hs (receiveSignal thread cap is_blocking) (Call receiveSignal_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and (\<lambda>y. isNotificationCap cap)) (UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool is_blocking\<rbrace>) hs (receiveSignal thread cap is_blocking) (Call receiveSignal_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and (\<lambda>y. isNotificationCap cap)) (UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool is_blocking\<rbrace>) hs (receiveSignal thread cap is_blocking) (Call receiveSignal_'proc) proof (prove)
goal (1 subgoal):
 1. isNotificationCap cap \<Longrightarrow> ccorres dc xfdc (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) (UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool is_blocking\<rbrace>) hs (receiveSignal thread cap is_blocking) (Call receiveSignal_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>isBlocking capa threada. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1637 isBlocking capa threada) (?Q'1637 isBlocking capa threada) (SKIP # hs) (do ntfn <- getNotification (capNtfnPtr cap);
case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | Structures_H.ntfn.WaitingNtfn queue \<Rightarrow> case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (queue @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread
od) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(capa);;
(\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(\<acute>ntfnPtr);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>ntfnPtr)));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(\<acute>ntfnPtr);;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(\<acute>ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(\<acute>ntfnPtr,\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(\<acute>ntfnPtr);;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(\<acute>ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)))
 2. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1637 isBlocking capa threada s \<and> s' \<in> ?Q'1637 isBlocking capa threada proof (prove)
goal (2 subgoals):
 1. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1643 isBlocking capa threada ntfn) (?P'1643 isBlocking capa threada ntfn) (SKIP # hs) (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | Structures_H.ntfn.WaitingNtfn queue \<Rightarrow> case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (queue @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(capa);;
(\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(\<acute>ntfnPtr);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>ntfnPtr)));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(\<acute>ntfnPtr);;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(\<acute>ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(\<acute>ntfnPtr,\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(\<acute>ntfnPtr);;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(\<acute>ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)))
 2. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ?P1643 isBlocking capa threada ntfn s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> ?P'1643 isBlocking capa threada ntfn} proof (prove)
goal (5 subgoals):
 1. \<And>isBlocking capa threada ntfn s. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. True \<and> (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(capa) ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__unsigned = capNtfnPtr cap\<rbrace>)
 2. \<And>isBlocking capa threada ntfn rv' t t'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(\<acute>ntfnPtr);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>ntfnPtr)));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(\<acute>ntfnPtr);;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(\<acute>ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(\<acute>ntfnPtr,\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(\<acute>ntfnPtr);;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(\<acute>ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)) (?y'1645 isBlocking capa threada ntfn rv')
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1645 isBlocking capa threada ntfn) (?Q1645 isBlocking capa threada ntfn) (SKIP # hs) (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | Structures_H.ntfn.WaitingNtfn queue \<Rightarrow> case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (queue @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (?y'1645 isBlocking capa threada ntfn (capNtfnPtr cap))
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. ?Q1645 isBlocking capa threada ntfn)
 5. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> (?P1645 isBlocking capa threada ntfn and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>capa s. \<lbrakk>isNotificationCap cap; ccap_relation cap capa\<rbrakk> \<Longrightarrow> UNIV \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> (\<forall>ret__unsigned. ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift capa) \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift capa)\<rparr>) \<in> rf_sr \<and> capNtfnPtr_CL (cap_notification_cap_lift capa) = capNtfnPtr cap)}
 2. \<And>isBlocking capa threada ntfn rv' t t'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(\<acute>ntfnPtr);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>ntfnPtr)));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(\<acute>ntfnPtr);;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(\<acute>ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(\<acute>ntfnPtr,\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(\<acute>ntfnPtr);;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(\<acute>ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)) (?y'1645 isBlocking capa threada ntfn rv')
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1645 isBlocking capa threada ntfn) (?Q1645 isBlocking capa threada ntfn) (SKIP # hs) (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | Structures_H.ntfn.WaitingNtfn queue \<Rightarrow> case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (queue @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (?y'1645 isBlocking capa threada ntfn (capNtfnPtr cap))
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. ?Q1645 isBlocking capa threada ntfn)
 5. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> (?P1645 isBlocking capa threada ntfn and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>capa s x v0 v1 v2 v3. \<lbrakk>ccap_relation (capability.NotificationCap v0 v1 v2 v3) capa; (s, x) \<in> rf_sr; cap = capability.NotificationCap v0 v1 v2 v3\<rbrakk> \<Longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift capa) = v0
 2. \<And>isBlocking capa threada ntfn rv' t t'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(\<acute>ntfnPtr);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>ntfnPtr)));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(\<acute>ntfnPtr);;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(\<acute>ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(\<acute>ntfnPtr,\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(\<acute>ntfnPtr);;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(\<acute>ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)) (?y'1645 isBlocking capa threada ntfn rv')
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1645 isBlocking capa threada ntfn) (?Q1645 isBlocking capa threada ntfn) (SKIP # hs) (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | Structures_H.ntfn.WaitingNtfn queue \<Rightarrow> case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (queue @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (?y'1645 isBlocking capa threada ntfn (capNtfnPtr cap))
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. ?Q1645 isBlocking capa threada ntfn)
 5. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> (?P1645 isBlocking capa threada ntfn and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>capa s x v0 v1 v2 v3. \<lbrakk>ccap_relation (capability.NotificationCap v0 v1 v2 v3) capa; (s, x) \<in> rf_sr; cap = capability.NotificationCap v0 v1 v2 v3; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrakk> \<Longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift capa) = v0
 2. \<And>isBlocking capa threada ntfn rv' t t'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(\<acute>ntfnPtr);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>ntfnPtr)));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(\<acute>ntfnPtr);;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(\<acute>ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(\<acute>ntfnPtr,\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(\<acute>ntfnPtr);;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(\<acute>ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)) (?y'1645 isBlocking capa threada ntfn rv')
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1645 isBlocking capa threada ntfn) (?Q1645 isBlocking capa threada ntfn) (SKIP # hs) (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | Structures_H.ntfn.WaitingNtfn queue \<Rightarrow> case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (queue @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (?y'1645 isBlocking capa threada ntfn (capNtfnPtr cap))
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. ?Q1645 isBlocking capa threada ntfn)
 5. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> (?P1645 isBlocking capa threada ntfn and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>isBlocking capa threada ntfn rv' t t'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(\<acute>ntfnPtr);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>ntfnPtr)));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(\<acute>ntfnPtr);;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(\<acute>ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(\<acute>ntfnPtr,\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(\<acute>ntfnPtr);;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(\<acute>ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)) (?y'1645 isBlocking capa threada ntfn rv')
 2. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1645 isBlocking capa threada ntfn) (?Q1645 isBlocking capa threada ntfn) (SKIP # hs) (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | Structures_H.ntfn.WaitingNtfn queue \<Rightarrow> case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (queue @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (?y'1645 isBlocking capa threada ntfn (capNtfnPtr cap))
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. ?Q1645 isBlocking capa threada ntfn)
 4. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> (?P1645 isBlocking capa threada ntfn and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1645 isBlocking capa threada ntfn) (?Q1645 isBlocking capa threada ntfn) (SKIP # hs) (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | Structures_H.ntfn.WaitingNtfn queue \<Rightarrow> case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (queue @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (\<acute>ntfnPtr :== ntfn_Ptr (capNtfnPtr cap);;
(\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(\<acute>ntfnPtr);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>ntfnPtr)));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(\<acute>ntfnPtr);;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(\<acute>ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(\<acute>ntfnPtr,\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(\<acute>ntfnPtr);;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(\<acute>ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI))
 2. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. ?Q1645 isBlocking capa threada ntfn)
 3. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> (?P1645 isBlocking capa threada ntfn and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1645 isBlocking capa threada ntfn) (?G'1780 isBlocking capa threada ntfn) (SKIP # hs) (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | Structures_H.ntfn.WaitingNtfn queue \<Rightarrow> case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (queue @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(ntfn_Ptr (capNtfnPtr cap));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 2. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> ?G'1780 isBlocking capa threada ntfn})
 3. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> (?P1645 isBlocking capa threada ntfn and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>isBlocking capa threada ntfn s. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. ko_at' ntfn (capNtfnPtr cap) s \<and> (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(ntfn_Ptr (capNtfnPtr cap)) ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__unsigned = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)\<rbrace>)
 2. \<And>isBlocking capa threada ntfn rv' t t'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI) (?y'2152 isBlocking capa threada ntfn rv')
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2152 isBlocking capa threada ntfn) (?Q2152 isBlocking capa threada ntfn) (SKIP # hs) (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | Structures_H.ntfn.WaitingNtfn queue \<Rightarrow> case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (queue @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (?y'2152 isBlocking capa threada ntfn (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting))
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. ?Q2152 isBlocking capa threada ntfn)
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 6. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> (?P2152 isBlocking capa threada ntfn and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>capa ntfn s x. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ko_at' ntfn (capNtfnPtr cap) s; (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr cap) \<and> notification_CL.state_CL (notification_lift (the (cslift x (ntfn_Ptr (capNtfnPtr cap))))) = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)
 2. \<And>isBlocking capa threada ntfn rv' t t'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI) (?y'2152 isBlocking capa threada ntfn rv')
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2152 isBlocking capa threada ntfn) (?Q2152 isBlocking capa threada ntfn) (SKIP # hs) (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | Structures_H.ntfn.WaitingNtfn queue \<Rightarrow> case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (queue @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (?y'2152 isBlocking capa threada ntfn (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting))
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. ?Q2152 isBlocking capa threada ntfn)
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 6. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> (?P2152 isBlocking capa threada ntfn and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>capa ntfn s x ko'. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ko_at' ntfn (capNtfnPtr cap) s; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr cap) \<and> notification_CL.state_CL (notification_lift (the (cslift x (ntfn_Ptr (capNtfnPtr cap))))) = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)
 2. \<And>isBlocking capa threada ntfn rv' t t'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI) (?y'2152 isBlocking capa threada ntfn rv')
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2152 isBlocking capa threada ntfn) (?Q2152 isBlocking capa threada ntfn) (SKIP # hs) (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | Structures_H.ntfn.WaitingNtfn queue \<Rightarrow> case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (queue @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (?y'2152 isBlocking capa threada ntfn (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting))
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. ?Q2152 isBlocking capa threada ntfn)
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 6. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> (?P2152 isBlocking capa threada ntfn and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>isBlocking capa threada ntfn rv' t t'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI) (?y'2152 isBlocking capa threada ntfn rv')
 2. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2152 isBlocking capa threada ntfn) (?Q2152 isBlocking capa threada ntfn) (SKIP # hs) (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | Structures_H.ntfn.WaitingNtfn queue \<Rightarrow> case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (queue @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (?y'2152 isBlocking capa threada ntfn (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting))
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. ?Q2152 isBlocking capa threada ntfn)
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 5. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> (?P2152 isBlocking capa threada ntfn and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2152 isBlocking capa threada ntfn) (?Q2152 isBlocking capa threada ntfn) (SKIP # hs) (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.ntfn.ActiveNtfn badge \<Rightarrow> do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od | Structures_H.ntfn.WaitingNtfn queue \<Rightarrow> case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (queue @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 2. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. ?Q2152 isBlocking capa threada ntfn)
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 4. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> (?P2152 isBlocking capa threada ntfn and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2523 isBlocking capa threada ntfn) (?R''2526 isBlocking capa threada ntfn) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 2. \<And>isBlocking capa threada ntfn x2. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2524 isBlocking capa threada ntfn x2) (?R''2527 isBlocking capa threada ntfn x2) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister x2;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 3. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> ?R''2526 isBlocking capa threada ntfn} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2527 isBlocking capa threada ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 6. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ?R2523 isBlocking capa threada ntfn s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2524 isBlocking capa threada ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2523 isBlocking capa threada ntfn) (?R'2531 isBlocking capa threada ntfn) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI)
 2. \<And>isBlocking capa threada ntfn x2. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2524 isBlocking capa threada ntfn x2) (?R''2527 isBlocking capa threada ntfn x2) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister x2;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 3. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> ?R'2531 isBlocking capa threada ntfn \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2527 isBlocking capa threada ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 6. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ?R2523 isBlocking capa threada ntfn s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2524 isBlocking capa threada ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2523 isBlocking capa threada ntfn) (?G'2535 isBlocking capa threada ntfn) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI)
 2. \<And>isBlocking capa threada ntfn x2. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2524 isBlocking capa threada ntfn x2) (?R''2527 isBlocking capa threada ntfn x2) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister x2;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 3. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> ?G'2535 isBlocking capa threada ntfn} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2527 isBlocking capa threada ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 6. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ?R2523 isBlocking capa threada ntfn s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2524 isBlocking capa threada ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2523 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (?G'2535 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od else doNBRecvFailedTransfer thread) (IF is_blocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI)
 2. \<And>isBlocking capa threada ntfn x2. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2524 isBlocking capa threada ntfn x2) (?R''2527 isBlocking capa threada ntfn x2) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister x2;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 3. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> ?G'2535 isBlocking capa threada ntfn} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2527 isBlocking capa threada ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 6. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ?R2523 isBlocking capa threada ntfn s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2524 isBlocking capa threada ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2548 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (?S2551 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (SKIP # hs) (do y <- setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),capNtfnPtr cap));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap)))
 2. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2547 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (?T2549 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 3. \<And>isBlocking capa threada ntfn x2. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2524 isBlocking capa threada ntfn x2) (?R''2527 isBlocking capa threada ntfn x2) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister x2;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 4. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> ?S2551 isBlocking capa threada ntfn) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2549 isBlocking capa threada ntfn)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2527 isBlocking capa threada ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 6. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 7. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> ?Q2548 isBlocking capa threada ntfn s) \<and> (\<not> is_blocking \<longrightarrow> ?R2547 isBlocking capa threada ntfn s)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2524 isBlocking capa threada ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2548 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (?S2551 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (SKIP # hs) (do y <- setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),capNtfnPtr cap));;
(CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
(\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
(\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>ntfn_queue);;
(CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap))))))))
 2. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2547 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (?T2549 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 3. \<And>isBlocking capa threada ntfn x2. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2524 isBlocking capa threada ntfn x2) (?R''2527 isBlocking capa threada ntfn x2) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister x2;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 4. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> ?S2551 isBlocking capa threada ntfn) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2549 isBlocking capa threada ntfn)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2527 isBlocking capa threada ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 6. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 7. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> ?Q2548 isBlocking capa threada ntfn s) \<and> (\<not> is_blocking \<longrightarrow> ?R2547 isBlocking capa threada ntfn s)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2524 isBlocking capa threada ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2548 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (?S2551 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (SKIP # hs) (do y <- setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),capNtfnPtr cap));;
(CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
(\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
(\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>ntfn_queue);;
(CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap)))))))
 2. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2547 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (?T2549 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 3. \<And>isBlocking capa threada ntfn x2. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2524 isBlocking capa threada ntfn x2) (?R''2527 isBlocking capa threada ntfn x2) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister x2;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 4. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> ?S2551 isBlocking capa threada ntfn) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2549 isBlocking capa threada ntfn)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2527 isBlocking capa threada ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 6. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 7. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> ?Q2548 isBlocking capa threada ntfn s) \<and> (\<not> is_blocking \<longrightarrow> ?R2547 isBlocking capa threada ntfn s)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2524 isBlocking capa threada ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2548 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (?S2551 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (SKIP # hs) (do y <- setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),capNtfnPtr cap));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
(\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
(\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>ntfn_queue);;
(CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap))))))
 2. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2547 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (?T2549 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 3. \<And>isBlocking capa threada ntfn x2. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2524 isBlocking capa threada ntfn x2) (?R''2527 isBlocking capa threada ntfn x2) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister x2;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 4. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> ?S2551 isBlocking capa threada ntfn) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2549 isBlocking capa threada ntfn)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2527 isBlocking capa threada ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 6. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 7. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> ?Q2548 isBlocking capa threada ntfn s) \<and> (\<not> is_blocking \<longrightarrow> ?R2547 isBlocking capa threada ntfn s)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2524 isBlocking capa threada ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (11 subgoals):
 1. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; is_blocking\<rbrakk> \<Longrightarrow> ccorres (?r'2582 isBlocking capa threada ntfn) (?xf'2582 isBlocking capa threada ntfn) (?P2588 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (?S2551 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) [] (setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),capNtfnPtr cap));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread))
 2. \<And>isBlocking capa threada ntfn rv' t t'. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; is_blocking\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'2582 isBlocking capa threada ntfn) rv' t t' (\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
(\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>ntfn_queue);;
(CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap))))) (?d'2582 isBlocking capa threada ntfn rv')
 3. \<And>isBlocking capa threada ntfn rv rv'. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; is_blocking; ?r'2582 isBlocking capa threada ntfn rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2582 isBlocking capa threada ntfn rv) (?Q'2582 isBlocking capa threada ntfn rv rv') (SKIP # hs) (setNotification (capNtfnPtr cap) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn)) (?d'2582 isBlocking capa threada ntfn rv')
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; is_blocking\<rbrakk> \<Longrightarrow> \<lbrace>?R2586 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread \<lbrace>?Q2582 isBlocking capa threada ntfn\<rbrace>
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; is_blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'2582 isBlocking capa threada ntfn) (?xf'2582 isBlocking capa threada ntfn) (?Q'2582 isBlocking capa threada ntfn)
 6. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2547 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (?T2549 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 7. \<And>isBlocking capa threada ntfn x2. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2524 isBlocking capa threada ntfn x2) (?R''2527 isBlocking capa threada ntfn x2) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister x2;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 8. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 9. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> ?S2551 isBlocking capa threada ntfn) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2549 isBlocking capa threada ntfn)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2527 isBlocking capa threada ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 10. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>isBlocking capa threada ntfn rv' t t'. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; is_blocking\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
(\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>ntfn_queue);;
(CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap))))) (?d'2582 isBlocking capa threada ntfn rv')
 2. \<And>isBlocking capa threada ntfn rv rv'. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; is_blocking; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2582 isBlocking capa threada ntfn rv) (?Q'2582 isBlocking capa threada ntfn rv rv') (SKIP # hs) (setNotification (capNtfnPtr cap) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn)) (?d'2582 isBlocking capa threada ntfn rv')
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; is_blocking\<rbrakk> \<Longrightarrow> \<lbrace>?R2586 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread \<lbrace>?Q2582 isBlocking capa threada ntfn\<rbrace>
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; is_blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2582 isBlocking capa threada ntfn)
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2547 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (?T2549 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 6. \<And>isBlocking capa threada ntfn x2. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2524 isBlocking capa threada ntfn x2) (?R''2527 isBlocking capa threada ntfn x2) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister x2;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 7. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 8. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2549 isBlocking capa threada ntfn)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2527 isBlocking capa threada ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 9. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 10. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and ?R2586 isBlocking capa threada ntfn) s) \<and> (\<not> is_blocking \<longrightarrow> ?R2547 isBlocking capa threada ntfn s)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2524 isBlocking capa threada ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>isBlocking capa threada ntfn rv rv'. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; is_blocking; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2582 isBlocking capa threada ntfn rv) (?Q'2582 isBlocking capa threada ntfn rv rv') (SKIP # hs) (setNotification (capNtfnPtr cap) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn)) (\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
(\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>ntfn_queue);;
(CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap)))))
 2. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; is_blocking\<rbrakk> \<Longrightarrow> \<lbrace>?R2586 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread \<lbrace>?Q2582 isBlocking capa threada ntfn\<rbrace>
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; is_blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2582 isBlocking capa threada ntfn)
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2547 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (?T2549 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 5. \<And>isBlocking capa threada ntfn x2. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2524 isBlocking capa threada ntfn x2) (?R''2527 isBlocking capa threada ntfn x2) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister x2;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 6. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 7. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2549 isBlocking capa threada ntfn)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2527 isBlocking capa threada ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 8. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 9. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and ?R2586 isBlocking capa threada ntfn) s) \<and> (\<not> is_blocking \<longrightarrow> ?R2547 isBlocking capa threada ntfn s)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2524 isBlocking capa threada ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>isBlocking capa threada ntfn rv rv'. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; is_blocking; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2582 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn rv) (?Q'2582 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn rv rv') (SKIP # hs) (setNotification (capNtfnPtr cap) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn)) (\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
(\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>ntfn_queue);;
(CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap)))))
 2. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; is_blocking\<rbrakk> \<Longrightarrow> \<lbrace>?R2586 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread \<lbrace>?Q2582 isBlocking capa threada ntfn\<rbrace>
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; is_blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2582 isBlocking capa threada ntfn)
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2547 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (?T2549 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 5. \<And>isBlocking capa threada ntfn x2. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2524 isBlocking capa threada ntfn x2) (?R''2527 isBlocking capa threada ntfn x2) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister x2;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 6. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 7. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2549 isBlocking capa threada ntfn)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2527 isBlocking capa threada ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 8. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 9. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and ?R2586 isBlocking capa threada ntfn) s) \<and> (\<not> is_blocking \<longrightarrow> ?R2547 isBlocking capa threada ntfn s)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2524 isBlocking capa threada ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; is_blocking\<rbrakk> \<Longrightarrow> \<lbrace>?R2586 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread \<lbrace>\<lambda>a. valid_pspace' and (\<lambda>s. sym_refs ((state_refs_of' s)(capNtfnPtr cap := set [thread] \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound}))) and st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = capNtfnPtr cap) thread and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>y. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> [thread] = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> [thread] = q @ [thread]))\<rbrace>
 2. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; is_blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2547 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (?T2549 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 4. \<And>isBlocking capa threada ntfn x2. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2524 isBlocking capa threada ntfn x2) (?R''2527 isBlocking capa threada ntfn x2) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister x2;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 5. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 6. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2549 isBlocking capa threada ntfn)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2527 isBlocking capa threada ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 7. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 8. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and ?R2586 isBlocking capa threada ntfn) s) \<and> (\<not> is_blocking \<longrightarrow> ?R2547 isBlocking capa threada ntfn s)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2524 isBlocking capa threada ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; is_blocking\<rbrakk> \<Longrightarrow> \<lbrace>?R2586 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread \<lbrace>\<lambda>a b. valid_pspace' b \<and> sym_refs (\<lambda>a. if a = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> state_refs_of' b (capNtfnPtr cap). snd r = NTFNBound} else state_refs_of' b a) \<and> st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = capNtfnPtr cap) thread b \<and> ko_at' ntfn (capNtfnPtr cap) b\<rbrace>
 2. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; is_blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2547 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (?T2549 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 4. \<And>isBlocking capa threada ntfn x2. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2524 isBlocking capa threada ntfn x2) (?R''2527 isBlocking capa threada ntfn x2) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister x2;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 5. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 6. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2549 isBlocking capa threada ntfn)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2527 isBlocking capa threada ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 7. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 8. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and ?R2586 isBlocking capa threada ntfn) s) \<and> (\<not> is_blocking \<longrightarrow> ?R2547 isBlocking capa threada ntfn s)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2524 isBlocking capa threada ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; is_blocking\<rbrakk> \<Longrightarrow> \<lbrace>?P'2643 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread \<lbrace>\<lambda>rv. ko_at' ntfn (capNtfnPtr cap)\<rbrace>
 2. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; is_blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2547 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (?T2549 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 4. \<And>isBlocking capa threada ntfn x2. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2524 isBlocking capa threada ntfn x2) (?R''2527 isBlocking capa threada ntfn x2) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister x2;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 5. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 6. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2549 isBlocking capa threada ntfn)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2527 isBlocking capa threada ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 7. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 8. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ?P'2643 isBlocking capa threada ntfn a)) s) \<and> (\<not> is_blocking \<longrightarrow> ?R2547 isBlocking capa threada ntfn s)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2524 isBlocking capa threada ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>isBlocking capa threada ntfn rv s. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; is_blocking; ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) s\<rbrakk> \<Longrightarrow> ko_at' ntfn (capNtfnPtr cap) s
 2. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; is_blocking\<rbrakk> \<Longrightarrow> \<lbrace>?P'2643 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread \<lbrace>\<lambda>rv. ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap)\<rbrace>
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; is_blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2547 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (?T2549 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 5. \<And>isBlocking capa threada ntfn x2. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2524 isBlocking capa threada ntfn x2) (?R''2527 isBlocking capa threada ntfn x2) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister x2;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 6. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 7. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2549 isBlocking capa threada ntfn)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2527 isBlocking capa threada ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 8. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 9. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ?P'2643 isBlocking capa threada ntfn a)) s) \<and> (\<not> is_blocking \<longrightarrow> ?R2547 isBlocking capa threada ntfn s)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2524 isBlocking capa threada ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; is_blocking\<rbrakk> \<Longrightarrow> \<lbrace>?P'2643 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread \<lbrace>\<lambda>rv. ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap)\<rbrace>
 2. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; is_blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2547 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (?T2549 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 4. \<And>isBlocking capa threada ntfn x2. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2524 isBlocking capa threada ntfn x2) (?R''2527 isBlocking capa threada ntfn x2) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister x2;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 5. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 6. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2549 isBlocking capa threada ntfn)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2527 isBlocking capa threada ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 7. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 8. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ?P'2643 isBlocking capa threada ntfn a)) s) \<and> (\<not> is_blocking \<longrightarrow> ?R2547 isBlocking capa threada ntfn s)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2524 isBlocking capa threada ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; is_blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 2. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2547 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (?T2549 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 3. \<And>isBlocking capa threada ntfn x2. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2524 isBlocking capa threada ntfn x2) (?R''2527 isBlocking capa threada ntfn x2) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister x2;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 4. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2549 isBlocking capa threada ntfn)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2527 isBlocking capa threada ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 6. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 7. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> ?R2547 isBlocking capa threada ntfn s)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2524 isBlocking capa threada ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2547 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (?T2549 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 2. \<And>isBlocking capa threada ntfn x2. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2524 isBlocking capa threada ntfn x2) (?R''2527 isBlocking capa threada ntfn x2) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister x2;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 3. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2549 isBlocking capa threada ntfn)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2527 isBlocking capa threada ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 6. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> ?R2547 isBlocking capa threada ntfn s)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2524 isBlocking capa threada ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) false; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2547 (SCAST(32 signed \<rightarrow> 32) false) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (?T2549 (SCAST(32 signed \<rightarrow> 32) false) capa (tcb_ptr_to_ctcb_ptr thread) ntfn) (SKIP # hs) (doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 2. \<And>isBlocking capa threada ntfn x2. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2524 isBlocking capa threada ntfn x2) (?R''2527 isBlocking capa threada ntfn x2) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister x2;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 3. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2549 isBlocking capa threada ntfn)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2527 isBlocking capa threada ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 6. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> ?R2547 isBlocking capa threada ntfn s)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2524 isBlocking capa threada ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>isBlocking capa threada ntfn x2. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2524 isBlocking capa threada ntfn x2) (?R''2527 isBlocking capa threada ntfn x2) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister x2;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 2. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2527 isBlocking capa threada ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 5. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2524 isBlocking capa threada ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2524 isBlocking capa threada ntfn badge) (?R''2527 isBlocking capa threada ntfn badge) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 2. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''2527 isBlocking capa threada ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 5. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2524 isBlocking capa threada ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2524 isBlocking capa threada ntfn badge) (?R'2667 isBlocking capa threada ntfn badge) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI)
 2. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R'2667 isBlocking capa threada ntfn x \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 5. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2524 isBlocking capa threada ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2524 isBlocking capa threada ntfn badge) (?R'2669 isBlocking capa threada ntfn badge) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle))
 2. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R'2669 isBlocking capa threada ntfn x \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 5. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2524 isBlocking capa threada ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2524 isBlocking capa threada ntfn badge) (?R'2669 isBlocking capa threada ntfn badge) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
(CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)))
 2. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R'2669 isBlocking capa threada ntfn x \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 5. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R2524 isBlocking capa threada ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>isBlocking capa threada ntfn badge s. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. ko_at' ntfn (capNtfnPtr cap) s \<and> (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap)) ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__unsigned = badge\<rbrace>)
 2. \<And>isBlocking capa threada ntfn badge rv' t t'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)) (?y'2672 isBlocking capa threada ntfn badge rv')
 3. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2672 isBlocking capa threada ntfn badge) (?Q2672 isBlocking capa threada ntfn badge) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (?y'2672 isBlocking capa threada ntfn badge badge)
 4. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = badge) ret__unsigned_' (\<lambda>rv rv'. ?Q2672 isBlocking capa threada ntfn badge)
 5. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 6. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 7. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 8. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (?P2672 isBlocking capa threada ntfn x and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>capa ntfn badge s x. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; ko_at' ntfn (capNtfnPtr cap) s; (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr cap) \<and> ntfnMsgIdentifier_CL (notification_lift (the (cslift x (ntfn_Ptr (capNtfnPtr cap))))) = badge
 2. \<And>isBlocking capa threada ntfn badge rv' t t'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)) (?y'2672 isBlocking capa threada ntfn badge rv')
 3. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2672 isBlocking capa threada ntfn badge) (?Q2672 isBlocking capa threada ntfn badge) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (?y'2672 isBlocking capa threada ntfn badge badge)
 4. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = badge) ret__unsigned_' (\<lambda>rv rv'. ?Q2672 isBlocking capa threada ntfn badge)
 5. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 6. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 7. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 8. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (?P2672 isBlocking capa threada ntfn x and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>capa ntfn badge s x ko'. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; ko_at' ntfn (capNtfnPtr cap) s; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr cap) \<and> ntfnMsgIdentifier_CL (notification_lift (the (cslift x (ntfn_Ptr (capNtfnPtr cap))))) = badge
 2. \<And>isBlocking capa threada ntfn badge rv' t t'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)) (?y'2672 isBlocking capa threada ntfn badge rv')
 3. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2672 isBlocking capa threada ntfn badge) (?Q2672 isBlocking capa threada ntfn badge) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (?y'2672 isBlocking capa threada ntfn badge badge)
 4. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = badge) ret__unsigned_' (\<lambda>rv rv'. ?Q2672 isBlocking capa threada ntfn badge)
 5. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 6. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 7. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 8. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (?P2672 isBlocking capa threada ntfn x and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>isBlocking capa threada ntfn badge rv' t t'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)) (?y'2672 isBlocking capa threada ntfn badge rv')
 2. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2672 isBlocking capa threada ntfn badge) (?Q2672 isBlocking capa threada ntfn badge) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (?y'2672 isBlocking capa threada ntfn badge badge)
 3. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = badge) ret__unsigned_' (\<lambda>rv rv'. ?Q2672 isBlocking capa threada ntfn badge)
 4. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 6. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 7. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (?P2672 isBlocking capa threada ntfn x and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2672 isBlocking capa threada ntfn badge) (?Q2672 isBlocking capa threada ntfn badge) (SKIP # hs) (do asUser thread $ setRegister Notification_H.badgeRegister badge;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn
od) (CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) badge);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle))
 2. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = badge) ret__unsigned_' (\<lambda>rv rv'. ?Q2672 isBlocking capa threada ntfn badge)
 3. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 6. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> (?P2672 isBlocking capa threada ntfn x and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>capa ntfn badge rv xfdca. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; dc rv xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2757 capa ntfn badge rv) (?Q'2757 capa ntfn badge rv xfdca) (SKIP # hs) (setNotification (capNtfnPtr cap) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn)) (CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle))
 2. \<And>capa ntfn badge. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> \<lbrace>?R2767 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn badge\<rbrace> asUser thread (setRegister ARM.badgeRegister badge) \<lbrace>?Q2757 capa ntfn badge\<rbrace>
 3. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = badge) ret__unsigned_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. badge) (reg_'_update (\<lambda>_. 0) (thread_'_update (\<lambda>_. threada) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H ARM.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badge\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'2764 isBlocking capa threada ntfn badge t rv})
 4. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 6. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 7. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and ?R2767 isBlocking capa threada ntfn x and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV}
flex-flex pairs:
\<lambda>capa. ?Q'2764 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) \<equiv>\<^sup>? \<lambda>capa ntfn badge t rv. ?Q'2757 capa ntfn badge rv (xfdc t) proof (prove)
goal (7 subgoals):
 1. \<And>capa ntfn badge rv xfdca. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; dc rv xfdca\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (invs' and ko_at' ntfn (capNtfnPtr cap)) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle) {s. \<exists>(rv, \<sigma>')\<in>fst (setNotification (capNtfnPtr cap) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)}
 2. \<And>capa ntfn badge. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> \<lbrace>?R2767 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn badge\<rbrace> asUser thread (setRegister ARM.badgeRegister badge) \<lbrace>\<lambda>a. invs' and ko_at' ntfn (capNtfnPtr cap)\<rbrace>
 3. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = badge) ret__unsigned_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. badge) (reg_'_update (\<lambda>_. 0) (thread_'_update (\<lambda>_. threada) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H ARM.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badge\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 4. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 6. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 7. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and ?R2767 isBlocking capa threada ntfn x and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>capa ntfn badge rv xfdca \<sigma>. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; dc rv xfdca\<rbrakk> \<Longrightarrow> {s. (invs' and ko_at' ntfn (capNtfnPtr cap)) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. s \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr cap) \<and> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr cap))))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals s))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (setNotification (capNtfnPtr cap) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<sigma>). (\<sigma>', s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr \<and> dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>))))}
 2. \<And>capa ntfn badge. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> \<lbrace>?R2767 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn badge\<rbrace> asUser thread (setRegister ARM.badgeRegister badge) \<lbrace>\<lambda>a. invs' and ko_at' ntfn (capNtfnPtr cap)\<rbrace>
 3. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = badge) ret__unsigned_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. badge) (reg_'_update (\<lambda>_. 0) (thread_'_update (\<lambda>_. threada) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H ARM.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badge\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 4. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 6. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 7. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and ?R2767 isBlocking capa threada ntfn x and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>capa ntfn badge \<sigma> x. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr cap) \<and> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr (capNtfnPtr cap))))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification (capNtfnPtr cap) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))
 2. \<And>capa ntfn badge. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> \<lbrace>?R2767 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn badge\<rbrace> asUser thread (setRegister ARM.badgeRegister badge) \<lbrace>\<lambda>a. invs' and ko_at' ntfn (capNtfnPtr cap)\<rbrace>
 3. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = badge) ret__unsigned_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. badge) (reg_'_update (\<lambda>_. 0) (thread_'_update (\<lambda>_. threada) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H ARM.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badge\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 4. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 6. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 7. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and ?R2767 isBlocking capa threada ntfn x and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>capa ntfn badge \<sigma> x. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; \<exists>ko'. cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko' \<and> cnotification_relation (cslift x) ntfn ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr cap) \<and> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr (capNtfnPtr cap))))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification (capNtfnPtr cap) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))
 2. \<And>capa ntfn badge. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> \<lbrace>?R2767 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn badge\<rbrace> asUser thread (setRegister ARM.badgeRegister badge) \<lbrace>\<lambda>a. invs' and ko_at' ntfn (capNtfnPtr cap)\<rbrace>
 3. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = badge) ret__unsigned_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. badge) (reg_'_update (\<lambda>_. 0) (thread_'_update (\<lambda>_. threada) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H ARM.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badge\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 4. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 6. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 7. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and ?R2767 isBlocking capa threada ntfn x and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>capa ntfn badge \<sigma> x ko' t notification. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setObject (capNtfnPtr cap) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>capa ntfn badge. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> \<lbrace>?R2767 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn badge\<rbrace> asUser thread (setRegister ARM.badgeRegister badge) \<lbrace>\<lambda>a. invs' and ko_at' ntfn (capNtfnPtr cap)\<rbrace>
 3. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = badge) ret__unsigned_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. badge) (reg_'_update (\<lambda>_. 0) (thread_'_update (\<lambda>_. threada) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H ARM.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badge\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 4. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 6. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 7. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and ?R2767 isBlocking capa threada ntfn x and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (11 subgoals):
 1. \<And>capa ntfn badge \<sigma> x ko' t notification. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> case ((), \<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(capNtfnPtr cap \<mapsto> injectKOS (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn))\<rparr>) of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>capa ntfn badge \<sigma> x ko' t notification val old ptr ptr' next. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>capa ntfn badge \<sigma> x ko' t notification v. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>capa ntfn badge \<sigma> x ko' t notification v v'. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>capa ntfn badge \<sigma> x ko' t notification. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P2841 capa ntfn badge \<sigma> x ko' t notification) (capNtfnPtr cap) \<sigma>
 6. \<And>capa ntfn badge. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> \<lbrace>?R2767 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn badge\<rbrace> asUser thread (setRegister ARM.badgeRegister badge) \<lbrace>\<lambda>a. invs' and ko_at' ntfn (capNtfnPtr cap)\<rbrace>
 7. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = badge) ret__unsigned_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. badge) (reg_'_update (\<lambda>_. 0) (thread_'_update (\<lambda>_. threada) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H ARM.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badge\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 8. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 9. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 10. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>capa ntfn badge \<sigma> x ko' t notification. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation \<and> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)) \<and> cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation \<and> cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr \<and> carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>) \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>) \<and> ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<and> ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>) \<and> cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState \<sigma>) (globals x) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x) \<and> cte_array_relation \<sigma> (globals x) \<and> tcb_cte_array_relation \<sigma> (globals x) \<and> apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>) \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>) \<and> ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma> \<and> x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr \<and> {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs \<and> x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr \<and> {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs \<and> htd_safe domain (hrs_htd (t_hrs_' (globals x))) \<and> - domain \<subseteq> kernel_data_refs \<and> globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list \<and> cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule \<and> ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>) \<and> ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>) \<and> ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(capNtfnPtr cap \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn)))) ((cslift x)(ntfn_Ptr (capNtfnPtr cap) \<mapsto> notification)) ntfn_Ptr (cnotification_relation (cslift x)) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rparr>)
 2. \<And>capa ntfn badge \<sigma> x ko' t notification val old ptr ptr' next. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>capa ntfn badge \<sigma> x ko' t notification v. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>capa ntfn badge \<sigma> x ko' t notification v v'. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>capa ntfn badge \<sigma> x ko' t notification. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P2841 capa ntfn badge \<sigma> x ko' t notification) (capNtfnPtr cap) \<sigma>
 6. \<And>capa ntfn badge. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> \<lbrace>?R2767 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn badge\<rbrace> asUser thread (setRegister ARM.badgeRegister badge) \<lbrace>\<lambda>a. invs' and ko_at' ntfn (capNtfnPtr cap)\<rbrace>
 7. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = badge) ret__unsigned_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. badge) (reg_'_update (\<lambda>_. 0) (thread_'_update (\<lambda>_. threada) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H ARM.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badge\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 8. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 9. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 10. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>capa ntfn badge \<sigma> x ko' t notification. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(capNtfnPtr cap \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn)))) ((cslift x)(ntfn_Ptr (capNtfnPtr cap) \<mapsto> notification)) ntfn_Ptr (cnotification_relation (cslift x)) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rparr>)
 2. \<And>capa ntfn badge \<sigma> x ko' t notification val old ptr ptr' next. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>capa ntfn badge \<sigma> x ko' t notification v. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>capa ntfn badge \<sigma> x ko' t notification v v'. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>capa ntfn badge \<sigma> x ko' t notification. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P2841 capa ntfn badge \<sigma> x ko' t notification) (capNtfnPtr cap) \<sigma>
 6. \<And>capa ntfn badge. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> \<lbrace>?R2767 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn badge\<rbrace> asUser thread (setRegister ARM.badgeRegister badge) \<lbrace>\<lambda>a. invs' and ko_at' ntfn (capNtfnPtr cap)\<rbrace>
 7. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = badge) ret__unsigned_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. badge) (reg_'_update (\<lambda>_. 0) (thread_'_update (\<lambda>_. threada) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H ARM.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badge\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 8. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 9. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 10. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>capa ntfn badge \<sigma> x ko' t notification. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(capNtfnPtr cap \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn)))) ((cslift x)(ntfn_Ptr (capNtfnPtr cap) \<mapsto> notification)) ntfn_Ptr (cnotification_relation (cslift x))
 2. \<And>capa ntfn badge \<sigma> x ko' t notification. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rparr>)
 3. \<And>capa ntfn badge \<sigma> x ko' t notification. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rparr>)
 4. \<And>capa ntfn badge \<sigma> x ko' t notification val old ptr ptr' next. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 5. \<And>capa ntfn badge \<sigma> x ko' t notification v. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 6. \<And>capa ntfn badge \<sigma> x ko' t notification v v'. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 7. \<And>capa ntfn badge \<sigma> x ko' t notification. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P2841 capa ntfn badge \<sigma> x ko' t notification) (capNtfnPtr cap) \<sigma>
 8. \<And>capa ntfn badge. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> \<lbrace>?R2767 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn badge\<rbrace> asUser thread (setRegister ARM.badgeRegister badge) \<lbrace>\<lambda>a. invs' and ko_at' ntfn (capNtfnPtr cap)\<rbrace>
 9. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = badge) ret__unsigned_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. badge) (reg_'_update (\<lambda>_. 0) (thread_'_update (\<lambda>_. threada) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H ARM.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badge\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 10. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>capa ntfn badge \<sigma> x ko' t notification. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cnotification_relation (cslift x) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) notification
 2. \<And>capa ntfn badge \<sigma> x ko' t notification. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn) then set (ntfnQueue (ntfnObj ntfn)) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn) then set (ntfnQueue (ntfnObj ntfn)) else {}))\<^esub>
 3. \<And>capa ntfn badge \<sigma> x ko' t notification. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rparr>)
 4. \<And>capa ntfn badge \<sigma> x ko' t notification. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rparr>)
 5. \<And>capa ntfn badge \<sigma> x ko' t notification val old ptr ptr' next. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>capa ntfn badge \<sigma> x ko' t notification v. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>capa ntfn badge \<sigma> x ko' t notification v v'. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>capa ntfn badge \<sigma> x ko' t notification. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P2841 capa ntfn badge \<sigma> x ko' t notification) (capNtfnPtr cap) \<sigma>
 9. \<And>capa ntfn badge. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> \<lbrace>?R2767 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn badge\<rbrace> asUser thread (setRegister ARM.badgeRegister badge) \<lbrace>\<lambda>a. invs' and ko_at' ntfn (capNtfnPtr cap)\<rbrace>
 10. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = badge) ret__unsigned_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. badge) (reg_'_update (\<lambda>_. 0) (thread_'_update (\<lambda>_. threada) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H ARM.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badge\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>capa ntfn badge \<sigma> x ko' t notification. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn) then set (ntfnQueue (ntfnObj ntfn)) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn) then set (ntfnQueue (ntfnObj ntfn)) else {}))\<^esub>
 2. \<And>capa ntfn badge \<sigma> x ko' t notification. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rparr>)
 3. \<And>capa ntfn badge \<sigma> x ko' t notification. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rparr>)
 4. \<And>capa ntfn badge \<sigma> x ko' t notification val old ptr ptr' next. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 5. \<And>capa ntfn badge \<sigma> x ko' t notification v. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 6. \<And>capa ntfn badge \<sigma> x ko' t notification v v'. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 7. \<And>capa ntfn badge \<sigma> x ko' t notification. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P2841 capa ntfn badge \<sigma> x ko' t notification) (capNtfnPtr cap) \<sigma>
 8. \<And>capa ntfn badge. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> \<lbrace>?R2767 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn badge\<rbrace> asUser thread (setRegister ARM.badgeRegister badge) \<lbrace>\<lambda>a. invs' and ko_at' ntfn (capNtfnPtr cap)\<rbrace>
 9. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = badge) ret__unsigned_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. badge) (reg_'_update (\<lambda>_. 0) (thread_'_update (\<lambda>_. threada) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H ARM.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badge\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 10. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>capa ntfn badge \<sigma> x ko' t notification. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rparr>)
 2. \<And>capa ntfn badge \<sigma> x ko' t notification. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rparr>)
 3. \<And>capa ntfn badge \<sigma> x ko' t notification val old ptr ptr' next. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 4. \<And>capa ntfn badge \<sigma> x ko' t notification v. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 5. \<And>capa ntfn badge \<sigma> x ko' t notification v v'. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 6. \<And>capa ntfn badge \<sigma> x ko' t notification. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P2841 capa ntfn badge \<sigma> x ko' t notification) (capNtfnPtr cap) \<sigma>
 7. \<And>capa ntfn badge. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> \<lbrace>?R2767 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn badge\<rbrace> asUser thread (setRegister ARM.badgeRegister badge) \<lbrace>\<lambda>a. invs' and ko_at' ntfn (capNtfnPtr cap)\<rbrace>
 8. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = badge) ret__unsigned_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. badge) (reg_'_update (\<lambda>_. 0) (thread_'_update (\<lambda>_. threada) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H ARM.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badge\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 9. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 10. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>capa ntfn badge \<sigma> x ko' t notification. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rparr>)
 2. \<And>capa ntfn badge \<sigma> x ko' t notification val old ptr ptr' next. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>capa ntfn badge \<sigma> x ko' t notification v. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>capa ntfn badge \<sigma> x ko' t notification v v'. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>capa ntfn badge \<sigma> x ko' t notification. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P2841 capa ntfn badge \<sigma> x ko' t notification) (capNtfnPtr cap) \<sigma>
 6. \<And>capa ntfn badge. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> \<lbrace>?R2767 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn badge\<rbrace> asUser thread (setRegister ARM.badgeRegister badge) \<lbrace>\<lambda>a. invs' and ko_at' ntfn (capNtfnPtr cap)\<rbrace>
 7. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = badge) ret__unsigned_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. badge) (reg_'_update (\<lambda>_. 0) (thread_'_update (\<lambda>_. threada) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H ARM.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badge\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 8. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 9. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 10. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>capa ntfn badge \<sigma> x ko' t notification val old ptr ptr' next. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 2. \<And>capa ntfn badge \<sigma> x ko' t notification v. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 3. \<And>capa ntfn badge \<sigma> x ko' t notification v v'. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 4. \<And>capa ntfn badge \<sigma> x ko' t notification. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P2841 capa ntfn badge \<sigma> x ko' t notification) (capNtfnPtr cap) \<sigma>
 5. \<And>capa ntfn badge. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> \<lbrace>?R2767 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn badge\<rbrace> asUser thread (setRegister ARM.badgeRegister badge) \<lbrace>\<lambda>a. invs' and ko_at' ntfn (capNtfnPtr cap)\<rbrace>
 6. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = badge) ret__unsigned_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. badge) (reg_'_update (\<lambda>_. 0) (thread_'_update (\<lambda>_. threada) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H ARM.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badge\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 7. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 8. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 9. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 10. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and ?R2767 isBlocking capa threada ntfn x and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>capa ntfn badge \<sigma> x ko' t notification v. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 2. \<And>capa ntfn badge \<sigma> x ko' t notification v v'. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 3. \<And>capa ntfn badge \<sigma> x ko' t notification. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P2841 capa ntfn badge \<sigma> x ko' t notification) (capNtfnPtr cap) \<sigma>
 4. \<And>capa ntfn badge. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> \<lbrace>?R2767 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn badge\<rbrace> asUser thread (setRegister ARM.badgeRegister badge) \<lbrace>\<lambda>a. invs' and ko_at' ntfn (capNtfnPtr cap)\<rbrace>
 5. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = badge) ret__unsigned_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. badge) (reg_'_update (\<lambda>_. 0) (thread_'_update (\<lambda>_. threada) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H ARM.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badge\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 6. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 7. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 8. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 9. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and ?R2767 isBlocking capa threada ntfn x and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>capa ntfn badge \<sigma> x ko' t notification v v'. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 2. \<And>capa ntfn badge \<sigma> x ko' t notification. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P2841 capa ntfn badge \<sigma> x ko' t notification) (capNtfnPtr cap) \<sigma>
 3. \<And>capa ntfn badge. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> \<lbrace>?R2767 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn badge\<rbrace> asUser thread (setRegister ARM.badgeRegister badge) \<lbrace>\<lambda>a. invs' and ko_at' ntfn (capNtfnPtr cap)\<rbrace>
 4. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = badge) ret__unsigned_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. badge) (reg_'_update (\<lambda>_. 0) (thread_'_update (\<lambda>_. threada) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H ARM.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badge\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 5. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 6. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 7. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 8. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and ?R2767 isBlocking capa threada ntfn x and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>capa ntfn badge \<sigma> x ko' t notification. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge; invs' \<sigma>; ko_at' ntfn (capNtfnPtr cap) \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr (capNtfnPtr cap)) = Some ko'; cnotification_relation (cslift x) ntfn ko'; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr (capNtfnPtr cap)) notification) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> obj_at' (?P2841 capa ntfn badge \<sigma> x ko' t notification) (capNtfnPtr cap) \<sigma>
 2. \<And>capa ntfn badge. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> \<lbrace>?R2767 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn badge\<rbrace> asUser thread (setRegister ARM.badgeRegister badge) \<lbrace>\<lambda>a. invs' and ko_at' ntfn (capNtfnPtr cap)\<rbrace>
 3. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = badge) ret__unsigned_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. badge) (reg_'_update (\<lambda>_. 0) (thread_'_update (\<lambda>_. threada) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H ARM.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badge\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 4. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 6. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 7. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and ?R2767 isBlocking capa threada ntfn x and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>capa ntfn badge. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> \<lbrace>?R2767 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn badge\<rbrace> asUser thread (setRegister ARM.badgeRegister badge) \<lbrace>\<lambda>a. invs' and ko_at' ntfn (capNtfnPtr cap)\<rbrace>
 2. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = badge) ret__unsigned_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. badge) (reg_'_update (\<lambda>_. 0) (thread_'_update (\<lambda>_. threada) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H ARM.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badge\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 3. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 6. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and ?R2767 isBlocking capa threada ntfn x and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>isBlocking capa threada ntfn badge. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn badge\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = badge) ret__unsigned_' (\<lambda>rv rv'. {s. w_'_update (\<lambda>_. badge) (reg_'_update (\<lambda>_. 0) (thread_'_update (\<lambda>_. threada) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H ARM.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badge\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 2. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 5. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn (capNtfnPtr cap) a) and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>capa ntfn s. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn (ret__unsigned_' s)\<rbrakk> \<Longrightarrow> s \<in> (if register_from_H ARM.badgeRegister = 0 then UNIV else {})
 2. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 5. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn (capNtfnPtr cap) a) and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>isBlocking capa threada ntfn x3. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn x3) (?R''2528 isBlocking capa threada ntfn x3) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 2. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 4. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn (capNtfnPtr cap) a) and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn list) (?R''2528 isBlocking capa threada ntfn list) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (list @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle THEN
  lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI
ELSE
  IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnMsgIdentifier_'proc(ntfn_Ptr (capNtfnPtr cap));;
CALL setRegister_'proc(threada,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Idle)
FI
FI)
 2. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''2528 isBlocking capa threada ntfn x}}))
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 4. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn (capNtfnPtr cap) a) and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn list) (?R'2909 isBlocking capa threada ntfn list) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (list @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (lvar_nondet_init ntfn_queue_' ntfn_queue_'_update;;
IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI)
 2. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R'2909 isBlocking capa threada ntfn x \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 4. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn (capNtfnPtr cap) a) and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 isBlocking capa threada ntfn list) (?G'2913 isBlocking capa threada ntfn list) (SKIP # hs) (case is_blocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (list @ [thread])) ntfn
od | False \<Rightarrow> doNBRecvFailedTransfer thread) (IF isBlocking \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(threada);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(threada,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(threada)
FI)
 2. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> ?G'2913 isBlocking capa threada ntfn x} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 4. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn (capNtfnPtr cap) a) and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2525 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (?G'2913 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (list @ [thread])) ntfn
od else doNBRecvFailedTransfer thread) (IF is_blocking THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ntfn_Ptr (capNtfnPtr cap)))));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap),\<acute>ntfn_queue)
ELSE
  CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread)
FI)
 2. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> ?G'2913 isBlocking capa threada ntfn x} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 4. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn (capNtfnPtr cap) a) and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R2525 isBlocking capa threada ntfn x s)) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2926 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (?S2929 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (SKIP # hs) (do y <- setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (list @ [thread])) ntfn)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),capNtfnPtr cap));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>ntfn_queue);;
CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap)))
 2. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2925 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (?T2927 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (list @ [thread])) ntfn
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> ?S2929 isBlocking capa threada ntfn x) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2927 isBlocking capa threada ntfn x)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 5. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn (capNtfnPtr cap) a) and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (is_blocking \<longrightarrow> ?Q2926 isBlocking capa threada ntfn x s) \<and> (\<not> is_blocking \<longrightarrow> ?R2925 isBlocking capa threada ntfn x s))) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2926 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (?S2929 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (SKIP # hs) (do y <- setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (list @ [thread])) ntfn)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),capNtfnPtr cap));;
(CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
(\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
(\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>ntfn_queue);;
(CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap))))))))
 2. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2925 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (?T2927 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (list @ [thread])) ntfn
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> ?S2929 isBlocking capa threada ntfn x) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2927 isBlocking capa threada ntfn x)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 5. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn (capNtfnPtr cap) a) and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (is_blocking \<longrightarrow> ?Q2926 isBlocking capa threada ntfn x s) \<and> (\<not> is_blocking \<longrightarrow> ?R2925 isBlocking capa threada ntfn x s))) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2926 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (?S2929 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (SKIP # hs) (do y <- setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (list @ [thread])) ntfn)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),capNtfnPtr cap));;
(CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
(\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
(\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>ntfn_queue);;
(CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap)))))))
 2. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2925 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (?T2927 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (list @ [thread])) ntfn
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> ?S2929 isBlocking capa threada ntfn x) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2927 isBlocking capa threada ntfn x)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 5. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn (capNtfnPtr cap) a) and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (is_blocking \<longrightarrow> ?Q2926 isBlocking capa threada ntfn x s) \<and> (\<not> is_blocking \<longrightarrow> ?R2925 isBlocking capa threada ntfn x s))) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2926 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (?S2929 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (SKIP # hs) (do y <- setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (list @ [thread])) ntfn)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),capNtfnPtr cap));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
(\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
(\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>ntfn_queue);;
(CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap))))))
 2. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2925 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (?T2927 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (list @ [thread])) ntfn
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> ?S2929 isBlocking capa threada ntfn x) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2927 isBlocking capa threada ntfn x)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 5. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn (capNtfnPtr cap) a) and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (is_blocking \<longrightarrow> ?Q2926 isBlocking capa threada ntfn x s) \<and> (\<not> is_blocking \<longrightarrow> ?R2925 isBlocking capa threada ntfn x s))) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking\<rbrakk> \<Longrightarrow> ccorres (?r'2960 isBlocking capa threada ntfn list) (?xf'2960 isBlocking capa threada ntfn list) (?P2966 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (?S2929 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) [] (setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),capNtfnPtr cap));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread))
 2. \<And>isBlocking capa threada ntfn list rv' t t'. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'2960 isBlocking capa threada ntfn list) rv' t t' (\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
(\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>ntfn_queue);;
(CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap))))) (?d'2960 isBlocking capa threada ntfn list rv')
 3. \<And>isBlocking capa threada ntfn list rv rv'. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking; ?r'2960 isBlocking capa threada ntfn list rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2960 isBlocking capa threada ntfn list rv) (?Q'2960 isBlocking capa threada ntfn list rv rv') (SKIP # hs) (setNotification (capNtfnPtr cap) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (list @ [thread])) ntfn)) (?d'2960 isBlocking capa threada ntfn list rv')
 4. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking\<rbrakk> \<Longrightarrow> \<lbrace>?R2964 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread \<lbrace>?Q2960 isBlocking capa threada ntfn list\<rbrace>
 5. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'2960 isBlocking capa threada ntfn list) (?xf'2960 isBlocking capa threada ntfn list) (?Q'2960 isBlocking capa threada ntfn list)
 6. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2925 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (?T2927 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (list @ [thread])) ntfn
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 7. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> ?S2929 isBlocking capa threada ntfn x) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2927 isBlocking capa threada ntfn x)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 8. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 9. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn (capNtfnPtr cap) a) and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (is_blocking \<longrightarrow> (?P2966 isBlocking capa threada ntfn x and ?R2964 isBlocking capa threada ntfn x) s) \<and> (\<not> is_blocking \<longrightarrow> ?R2925 isBlocking capa threada ntfn x s))) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking\<rbrakk> \<Longrightarrow> ccorres (?r'2960 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (?xf'2960 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (?P2966 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (?S2929 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) [] (setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnNotification));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),capNtfnPtr cap));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread))
 2. \<And>isBlocking capa threada ntfn list rv' t t'. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'2960 isBlocking capa threada ntfn list) rv' t t' (\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
(\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>ntfn_queue);;
(CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap))))) (?d'2960 isBlocking capa threada ntfn list rv')
 3. \<And>isBlocking capa threada ntfn list rv rv'. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking; ?r'2960 isBlocking capa threada ntfn list rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2960 isBlocking capa threada ntfn list rv) (?Q'2960 isBlocking capa threada ntfn list rv rv') (SKIP # hs) (setNotification (capNtfnPtr cap) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (list @ [thread])) ntfn)) (?d'2960 isBlocking capa threada ntfn list rv')
 4. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking\<rbrakk> \<Longrightarrow> \<lbrace>?R2964 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread \<lbrace>?Q2960 isBlocking capa threada ntfn list\<rbrace>
 5. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'2960 isBlocking capa threada ntfn list) (?xf'2960 isBlocking capa threada ntfn list) (?Q'2960 isBlocking capa threada ntfn list)
 6. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2925 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (?T2927 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (list @ [thread])) ntfn
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 7. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> ?S2929 isBlocking capa threada ntfn x) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2927 isBlocking capa threada ntfn x)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 8. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 9. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn (capNtfnPtr cap) a) and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (is_blocking \<longrightarrow> (?P2966 isBlocking capa threada ntfn x and ?R2964 isBlocking capa threada ntfn x) s) \<and> (\<not> is_blocking \<longrightarrow> ?R2925 isBlocking capa threada ntfn x s))) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>isBlocking capa threada ntfn list rv' t t'. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
(\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>ntfn_queue);;
(CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap))))) (?d'2960 isBlocking capa threada ntfn list rv')
 2. \<And>isBlocking capa threada ntfn list rv rv'. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2960 isBlocking capa threada ntfn list rv) (?Q'2960 isBlocking capa threada ntfn list rv rv') (SKIP # hs) (setNotification (capNtfnPtr cap) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (list @ [thread])) ntfn)) (?d'2960 isBlocking capa threada ntfn list rv')
 3. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking\<rbrakk> \<Longrightarrow> \<lbrace>?R2964 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread \<lbrace>?Q2960 isBlocking capa threada ntfn list\<rbrace>
 4. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2960 isBlocking capa threada ntfn list)
 5. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2925 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (?T2927 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (list @ [thread])) ntfn
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 6. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2927 isBlocking capa threada ntfn x)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 7. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 8. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn (capNtfnPtr cap) a) and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and ?R2964 isBlocking capa threada ntfn x) s) \<and> (\<not> is_blocking \<longrightarrow> ?R2925 isBlocking capa threada ntfn x s))) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>isBlocking capa threada ntfn list rv rv'. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2960 isBlocking capa threada ntfn list rv) (?Q'2960 isBlocking capa threada ntfn list rv rv') (SKIP # hs) (setNotification (capNtfnPtr cap) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (list @ [thread])) ntfn)) (\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
(\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>ntfn_queue);;
(CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap)))))
 2. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking\<rbrakk> \<Longrightarrow> \<lbrace>?R2964 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread \<lbrace>?Q2960 isBlocking capa threada ntfn list\<rbrace>
 3. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2960 isBlocking capa threada ntfn list)
 4. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2925 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (?T2927 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (list @ [thread])) ntfn
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2927 isBlocking capa threada ntfn x)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 6. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 7. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn (capNtfnPtr cap) a) and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and ?R2964 isBlocking capa threada ntfn x) s) \<and> (\<not> is_blocking \<longrightarrow> ?R2925 isBlocking capa threada ntfn x s))) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>isBlocking capa threada ntfn list rv rv'. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2960 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list rv) (?Q'2960 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list rv rv') (SKIP # hs) (setNotification (capNtfnPtr cap) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (list @ [thread])) ntfn)) (\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr (capNtfnPtr cap));;
(\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>ntfn_queue);;
(CALL notification_ptr_set_state_'proc(ntfn_Ptr (capNtfnPtr cap),SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr (capNtfnPtr cap)))))
 2. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking\<rbrakk> \<Longrightarrow> \<lbrace>?R2964 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread \<lbrace>?Q2960 isBlocking capa threada ntfn list\<rbrace>
 3. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2960 isBlocking capa threada ntfn list)
 4. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2925 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (?T2927 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (list @ [thread])) ntfn
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2927 isBlocking capa threada ntfn x)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 6. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 7. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn (capNtfnPtr cap) a) and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and ?R2964 isBlocking capa threada ntfn x) s) \<and> (\<not> is_blocking \<longrightarrow> ?R2925 isBlocking capa threada ntfn x s))) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking\<rbrakk> \<Longrightarrow> \<lbrace>?R2964 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread \<lbrace>\<lambda>a. valid_pspace' and (\<lambda>s. sym_refs ((state_refs_of' s)(capNtfnPtr cap := set (list @ [thread]) \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound}))) and st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = capNtfnPtr cap) thread and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>y. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> list @ [thread] = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> list @ [thread] = q @ [thread]))\<rbrace>
 2. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 3. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2925 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (?T2927 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (list @ [thread])) ntfn
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2927 isBlocking capa threada ntfn x)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 6. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn (capNtfnPtr cap) a) and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and ?R2964 isBlocking capa threada ntfn x) s) \<and> (\<not> is_blocking \<longrightarrow> ?R2925 isBlocking capa threada ntfn x s))) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking\<rbrakk> \<Longrightarrow> \<lbrace>?R2964 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread \<lbrace>\<lambda>a b. valid_pspace' b \<and> sym_refs (\<lambda>a. if a = capNtfnPtr cap then insert (thread, NTFNSignal) (set list \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' b (capNtfnPtr cap). snd r = NTFNBound}) else state_refs_of' b a) \<and> st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = capNtfnPtr cap) thread b \<and> ko_at' ntfn (capNtfnPtr cap) b \<and> thread \<notin> set list\<rbrace>
 2. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 3. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2925 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (?T2927 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (list @ [thread])) ntfn
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2927 isBlocking capa threada ntfn x)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 6. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn (capNtfnPtr cap) a) and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and ?R2964 isBlocking capa threada ntfn x) s) \<and> (\<not> is_blocking \<longrightarrow> ?R2925 isBlocking capa threada ntfn x s))) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking\<rbrakk> \<Longrightarrow> \<lbrace>?P'3015 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread \<lbrace>\<lambda>rv s. ko_at' ntfn (capNtfnPtr cap) s \<and> thread \<notin> set list\<rbrace>
 2. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 3. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2925 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (?T2927 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (list @ [thread])) ntfn
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2927 isBlocking capa threada ntfn x)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 6. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn (capNtfnPtr cap) a) and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) (set x \<times> {NTFNSignal} \<union> {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ?P'3015 isBlocking capa threada ntfn x a)) s) \<and> (\<not> is_blocking \<longrightarrow> ?R2925 isBlocking capa threada ntfn x s))) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>isBlocking capa threada ntfn list rv s. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking; (ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) and K (thread \<notin> set list)) s\<rbrakk> \<Longrightarrow> ko_at' ntfn (capNtfnPtr cap) s \<and> thread \<notin> set list
 2. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking\<rbrakk> \<Longrightarrow> \<lbrace>?P'3015 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread \<lbrace>\<lambda>rv. ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) and K (thread \<notin> set list)\<rbrace>
 3. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 4. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2925 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (?T2927 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (list @ [thread])) ntfn
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2927 isBlocking capa threada ntfn x)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 6. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 7. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn (capNtfnPtr cap) a) and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) (set x \<times> {NTFNSignal} \<union> {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ?P'3015 isBlocking capa threada ntfn x a)) s) \<and> (\<not> is_blocking \<longrightarrow> ?R2925 isBlocking capa threada ntfn x s))) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking\<rbrakk> \<Longrightarrow> \<lbrace>?P'3015 (SCAST(32 signed \<rightarrow> 32) true) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread \<lbrace>\<lambda>rv. ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) and K (thread \<notin> set list)\<rbrace>
 2. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 3. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2925 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (?T2927 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (list @ [thread])) ntfn
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2927 isBlocking capa threada ntfn x)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 5. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 6. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn (capNtfnPtr cap) a) and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) (set x \<times> {NTFNSignal} \<union> {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ?P'3015 isBlocking capa threada ntfn x a)) s) \<and> (\<not> is_blocking \<longrightarrow> ?R2925 isBlocking capa threada ntfn x s))) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) true; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; is_blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 2. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2925 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (?T2927 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (list @ [thread])) ntfn
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2927 isBlocking capa threada ntfn x)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 4. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 5. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn (capNtfnPtr cap) a) and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) (set x \<times> {NTFNSignal} \<union> {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a \<and> K (thread \<notin> set x) a)) s) \<and> (\<not> is_blocking \<longrightarrow> ?R2925 isBlocking capa threada ntfn x s))) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2925 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (?T2927 (from_bool is_blocking) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (SKIP # hs) (if is_blocking then do setThreadState (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) thread;
setNotification (capNtfnPtr cap) $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (list @ [thread])) ntfn
od else doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 2. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2927 isBlocking capa threada ntfn x)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 4. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn (capNtfnPtr cap) a) and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) (set x \<times> {NTFNSignal} \<union> {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a \<and> K (thread \<notin> set x) a)) s) \<and> (\<not> is_blocking \<longrightarrow> ?R2925 isBlocking capa threada ntfn x s))) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>isBlocking capa threada ntfn list. \<lbrakk>isNotificationCap cap; isBlocking = SCAST(32 signed \<rightarrow> 32) false; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; \<not> is_blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2925 (SCAST(32 signed \<rightarrow> 32) false) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (?T2927 (SCAST(32 signed \<rightarrow> 32) false) capa (tcb_ptr_to_ctcb_ptr thread) ntfn list) (SKIP # hs) (doNBRecvFailedTransfer thread) (CALL doNBRecvFailedTransfer_'proc(tcb_ptr_to_ctcb_ptr thread))
 2. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> ?T2927 isBlocking capa threada ntfn x)}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 3. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 4. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn (capNtfnPtr cap) a) and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) (set x \<times> {NTFNSignal} \<union> {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a \<and> K (thread \<notin> set x) a)) s) \<and> (\<not> is_blocking \<longrightarrow> ?R2925 isBlocking capa threada ntfn x s))) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active\<rbrace> \<inter> - \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v. ntfn_queue_'_update (\<lambda>_. v) s \<in> {s. (is_blocking \<longrightarrow> s \<in> UNIV) \<and> (\<not> is_blocking \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. threada) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = threada\<rbrace>})}} \<inter> \<lbrace>(case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<or> (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle\<rbrace>}}))
 2. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 3. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn (capNtfnPtr cap) a) and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) (set x \<times> {NTFNSignal} \<union> {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a \<and> K (thread \<notin> set x) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True))) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>isBlocking capa threada ntfn. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capNtfnPtr cap) ret__unsigned_' (\<lambda>rv rv'. {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr cap)) s \<in> UNIV})
 2. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn (capNtfnPtr cap) a) and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) (set x \<times> {NTFNSignal} \<union> {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a \<and> K (thread \<notin> set x) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True))) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. \<And>isBlocking capa threada s s'. \<lbrakk>isNotificationCap cap; isBlocking = from_bool is_blocking; ccap_relation cap capa; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (invs' and valid_cap' cap and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> ((\<lambda>s. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' and tcb_at' thread) a \<and> ko_at' ntfn (capNtfnPtr cap) a) and ko_at' ntfn (capNtfnPtr cap)) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (is_blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and sch_act_not thread and valid_objs' and ntfn_at' (capNtfnPtr cap) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and (\<lambda>y. capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap))) a \<and> sym_refs (\<lambda>b. if b = capNtfnPtr cap then insert (thread, NTFNSignal) (set x \<times> {NTFNSignal} \<union> {r \<in> ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) (capNtfnPtr cap). snd r = NTFNBound}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) b) \<and> (if thread = thread then K (isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> waitingOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) = capNtfnPtr cap) else st_tcb_at' (\<lambda>a. isBlockedOnNotification a \<and> waitingOnNotification a = capNtfnPtr cap) thread) a \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) a \<and> K (thread \<notin> set x) a)) s) \<and> (\<not> is_blocking \<longrightarrow> True))) and ko_at' ntfn (capNtfnPtr cap) and (\<lambda>_. True)) s) \<and> s' \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. \<And>capa s s'. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))\<rbrakk> \<Longrightarrow> (capNtfnPtr cap = thread \<longrightarrow> (\<forall>ntfn. ko_at' ntfn thread s \<longrightarrow> (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> is_blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ntfn_at' thread s \<and> sch_act_wf (ksSchedulerAction s) s \<and> thread = thread && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification thread) s \<and> sym_refs (\<lambda>a. if a = thread then insert (thread, NTFNSignal) {r. (r = (thread, TCBSignal) \<or> r \<in> state_refs_of' s thread \<and> snd r = TCBBound) \<and> snd r = NTFNBound} else state_refs_of' s a) \<and> isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification thread) \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) thread s) \<and> ((\<exists>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> tcb_at' thread s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> is_blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ntfn_at' thread s \<and> sch_act_wf (ksSchedulerAction s) s \<and> thread = thread && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification thread) s \<and> sym_refs (\<lambda>a. if a = thread then insert (thread, NTFNSignal) (set x \<times> {NTFNSignal} \<union> {r. (r = (thread, TCBSignal) \<or> r \<in> state_refs_of' s thread \<and> snd r = TCBBound) \<and> snd r = NTFNBound}) else state_refs_of' s a) \<and> isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification thread) \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) thread s \<and> thread \<notin> set x))) \<and> (capNtfnPtr cap \<noteq> thread \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> is_blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ntfn_at' (capNtfnPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) s \<and> sym_refs (\<lambda>a. if a = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound} else if a = thread then insert (capNtfnPtr cap, TCBSignal) {r \<in> state_refs_of' s thread. snd r = TCBBound} else state_refs_of' s a) \<and> isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) s) \<and> ((\<exists>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> tcb_at' thread s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> is_blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ntfn_at' (capNtfnPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) s \<and> sym_refs (\<lambda>a. if a = capNtfnPtr cap then insert (thread, NTFNSignal) (set x \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound}) else if a = thread then insert (capNtfnPtr cap, TCBSignal) {r \<in> state_refs_of' s thread. snd r = TCBBound} else state_refs_of' s a) \<and> isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) s \<and> thread \<notin> set x))) proof (prove)
goal (2 subgoals):
 1. \<And>capa s s'. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))\<rbrakk> \<Longrightarrow> capNtfnPtr cap = thread \<longrightarrow> (\<forall>ntfn. ko_at' ntfn thread s \<longrightarrow> (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> is_blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ntfn_at' thread s \<and> sch_act_wf (ksSchedulerAction s) s \<and> thread = thread && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification thread) s \<and> sym_refs (\<lambda>a. if a = thread then insert (thread, NTFNSignal) {r. (r = (thread, TCBSignal) \<or> r \<in> state_refs_of' s thread \<and> snd r = TCBBound) \<and> snd r = NTFNBound} else state_refs_of' s a) \<and> isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification thread) \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) thread s) \<and> ((\<exists>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> tcb_at' thread s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> is_blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ntfn_at' thread s \<and> sch_act_wf (ksSchedulerAction s) s \<and> thread = thread && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification thread) s \<and> sym_refs (\<lambda>a. if a = thread then insert (thread, NTFNSignal) (set x \<times> {NTFNSignal} \<union> {r. (r = (thread, TCBSignal) \<or> r \<in> state_refs_of' s thread \<and> snd r = TCBBound) \<and> snd r = NTFNBound}) else state_refs_of' s a) \<and> isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification thread) \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) thread s \<and> thread \<notin> set x))
 2. \<And>capa s s'. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))\<rbrakk> \<Longrightarrow> capNtfnPtr cap \<noteq> thread \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> is_blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ntfn_at' (capNtfnPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) s \<and> sym_refs (\<lambda>a. if a = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound} else if a = thread then insert (capNtfnPtr cap, TCBSignal) {r \<in> state_refs_of' s thread. snd r = TCBBound} else state_refs_of' s a) \<and> isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) s) \<and> ((\<exists>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> tcb_at' thread s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> is_blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ntfn_at' (capNtfnPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) s \<and> sym_refs (\<lambda>a. if a = capNtfnPtr cap then insert (thread, NTFNSignal) (set x \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound}) else if a = thread then insert (capNtfnPtr cap, TCBSignal) {r \<in> state_refs_of' s thread. snd r = TCBBound} else state_refs_of' s a) \<and> isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) s \<and> thread \<notin> set x)) proof (prove)
goal (1 subgoal):
 1. \<And>capa s s'. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))\<rbrakk> \<Longrightarrow> capNtfnPtr cap \<noteq> thread \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr cap) s \<longrightarrow> (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> is_blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ntfn_at' (capNtfnPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) s \<and> sym_refs (\<lambda>a. if a = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound} else if a = thread then insert (capNtfnPtr cap, TCBSignal) {r \<in> state_refs_of' s thread. snd r = TCBBound} else state_refs_of' s a) \<and> isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) s) \<and> ((\<exists>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> tcb_at' thread s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> is_blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ntfn_at' (capNtfnPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) s \<and> sym_refs (\<lambda>a. if a = capNtfnPtr cap then insert (thread, NTFNSignal) (set x \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound}) else if a = thread then insert (capNtfnPtr cap, TCBSignal) {r \<in> state_refs_of' s thread. snd r = TCBBound} else state_refs_of' s a) \<and> isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) s \<and> thread \<notin> set x)) proof (prove)
goal (1 subgoal):
 1. \<And>capa s s' ntfn. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s\<rbrakk> \<Longrightarrow> (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> is_blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ntfn_at' (capNtfnPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) s \<and> sym_refs (\<lambda>a. if a = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound} else if a = thread then insert (capNtfnPtr cap, TCBSignal) {r \<in> state_refs_of' s thread. snd r = TCBBound} else state_refs_of' s a) \<and> isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) s) \<and> ((\<exists>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> tcb_at' thread s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> is_blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ntfn_at' (capNtfnPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) s \<and> sym_refs (\<lambda>a. if a = capNtfnPtr cap then insert (thread, NTFNSignal) (set x \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound}) else if a = thread then insert (capNtfnPtr cap, TCBSignal) {r \<in> state_refs_of' s thread. snd r = TCBBound} else state_refs_of' s a) \<and> isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) s \<and> thread \<notin> set x) proof (prove)
goal (2 subgoals):
 1. \<And>capa s s' ntfn ko. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; projectKO_opt ko = Some ntfn\<rbrakk> \<Longrightarrow> injectKOS ntfn = ko
 2. \<And>capa s s' ntfn. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; valid_obj' (injectKOS ntfn) s\<rbrakk> \<Longrightarrow> (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> is_blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ntfn_at' (capNtfnPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) s \<and> sym_refs (\<lambda>a. if a = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound} else if a = thread then insert (capNtfnPtr cap, TCBSignal) {r \<in> state_refs_of' s thread. snd r = TCBBound} else state_refs_of' s a) \<and> isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) s) \<and> ((\<exists>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> tcb_at' thread s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> is_blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ntfn_at' (capNtfnPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) s \<and> sym_refs (\<lambda>a. if a = capNtfnPtr cap then insert (thread, NTFNSignal) (set x \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound}) else if a = thread then insert (capNtfnPtr cap, TCBSignal) {r \<in> state_refs_of' s thread. snd r = TCBBound} else state_refs_of' s a) \<and> isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) s \<and> thread \<notin> set x) proof (prove)
goal (1 subgoal):
 1. \<And>capa s s' ntfn. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; valid_obj' (injectKOS ntfn) s\<rbrakk> \<Longrightarrow> (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> is_blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ntfn_at' (capNtfnPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) s \<and> sym_refs (\<lambda>a. if a = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound} else if a = thread then insert (capNtfnPtr cap, TCBSignal) {r \<in> state_refs_of' s thread. snd r = TCBBound} else state_refs_of' s a) \<and> isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) s) \<and> ((\<exists>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> tcb_at' thread s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> is_blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ntfn_at' (capNtfnPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) s \<and> sym_refs (\<lambda>a. if a = capNtfnPtr cap then insert (thread, NTFNSignal) (set x \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound}) else if a = thread then insert (capNtfnPtr cap, TCBSignal) {r \<in> state_refs_of' s thread. snd r = TCBBound} else state_refs_of' s a) \<and> isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) s \<and> thread \<notin> set x) proof (prove)
goal (2 subgoals):
 1. \<And>capa s s' ntfn. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; valid_obj' (injectKOS ntfn) s; state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}\<rbrakk> \<Longrightarrow> (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> is_blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ntfn_at' (capNtfnPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) s \<and> sym_refs (\<lambda>a. if a = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound} else if a = thread then insert (capNtfnPtr cap, TCBSignal) {r \<in> state_refs_of' s thread. snd r = TCBBound} else state_refs_of' s a) \<and> isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) s) \<and> ((\<exists>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> tcb_at' thread s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> is_blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ntfn_at' (capNtfnPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) s \<and> sym_refs (\<lambda>a. if a = capNtfnPtr cap then insert (thread, NTFNSignal) (set x \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound}) else if a = thread then insert (capNtfnPtr cap, TCBSignal) {r \<in> state_refs_of' s thread. snd r = TCBBound} else state_refs_of' s a) \<and> isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) s \<and> thread \<notin> set x)
 2. \<And>capa s s' ntfn. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; valid_obj' (injectKOS ntfn) s\<rbrakk> \<Longrightarrow> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound} proof (prove)
goal (3 subgoals):
 1. \<And>capa s s' ntfn. \<lbrakk>state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; valid_bound_tcb' (ntfnBoundTCB ntfn) s; is_blocking\<rbrakk> \<Longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ntfn_at' (capNtfnPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) s \<and> sym_refs (\<lambda>a. if a = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound} else if a = thread then insert (capNtfnPtr cap, TCBSignal) (state_refs_of' s thread) else state_refs_of' s a) \<and> isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) s
 2. \<And>capa s s' ntfn x3. \<lbrakk>state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB ntfn of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB ntfn) s; is_blocking\<rbrakk> \<Longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ntfn_at' (capNtfnPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) s \<and> sym_refs (\<lambda>a. if a = capNtfnPtr cap then insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound}) else if a = thread then insert (capNtfnPtr cap, TCBSignal) (state_refs_of' s thread) else state_refs_of' s a) \<and> isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) s \<and> thread \<notin> set x3
 3. \<And>capa s s' ntfn. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; valid_obj' (injectKOS ntfn) s\<rbrakk> \<Longrightarrow> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound} proof (prove)
goal (4 subgoals):
 1. \<And>capa s s' ntfn. \<lbrakk>state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; valid_bound_tcb' (ntfnBoundTCB ntfn) s; is_blocking; state_refs_of' s (capNtfnPtr cap) = {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound}\<rbrakk> \<Longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ntfn_at' (capNtfnPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) s \<and> sym_refs (\<lambda>a. if a = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound} else if a = thread then insert (capNtfnPtr cap, TCBSignal) (state_refs_of' s thread) else state_refs_of' s a) \<and> isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) s
 2. \<And>capa s s' ntfn. \<lbrakk>state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; valid_bound_tcb' (ntfnBoundTCB ntfn) s; is_blocking\<rbrakk> \<Longrightarrow> state_refs_of' s (capNtfnPtr cap) = {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound}
 3. \<And>capa s s' ntfn x3. \<lbrakk>state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB ntfn of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB ntfn) s; is_blocking\<rbrakk> \<Longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ntfn_at' (capNtfnPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) s \<and> sym_refs (\<lambda>a. if a = capNtfnPtr cap then insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound}) else if a = thread then insert (capNtfnPtr cap, TCBSignal) (state_refs_of' s thread) else state_refs_of' s a) \<and> isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) s \<and> thread \<notin> set x3
 4. \<And>capa s s' ntfn. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; valid_obj' (injectKOS ntfn) s\<rbrakk> \<Longrightarrow> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>state_refs_of' s_ thread = {r \<in> state_refs_of' s_ thread. snd r = TCBBound}; isNotificationCap cap; ccap_relation cap capa_; (s_, s'_) \<in> rf_sr; invs' s_; valid_cap' cap s_; st_tcb_at' simple' thread s_; sch_act_not thread s_; \<forall>d p. thread \<notin> set (ksReadyQueues s_ (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn_ (capNtfnPtr cap) s_; ntfnObj ntfn_ = Structures_H.ntfn.IdleNtfn; valid_bound_tcb' (ntfnBoundTCB ntfn_) s_; is_blocking; state_refs_of' s_ (capNtfnPtr cap) = {r \<in> state_refs_of' s_ (capNtfnPtr cap). snd r = NTFNBound}\<rbrakk> \<Longrightarrow> tcb_at' thread s_ \<and> Invariants_H.valid_queues s_ \<and> valid_objs' s_ \<and> ntfn_at' (capNtfnPtr cap) s_ \<and> sch_act_wf (ksSchedulerAction s_) s_ \<and> capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4 \<and> valid_pspace' s_ \<and> tcb_at' thread s_ \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) s_ \<and> sym_refs (\<lambda>a. if a = capNtfnPtr cap then insert (thread, NTFNSignal) {r \<in> state_refs_of' s_ (capNtfnPtr cap). snd r = NTFNBound} else if a = thread then insert (capNtfnPtr cap, TCBSignal) (state_refs_of' s_ thread) else state_refs_of' s_ a) \<and> isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn_ \<and> projectKO_opt x = None) (capNtfnPtr cap) s_ proof (prove)
goal (3 subgoals):
 1. \<And>capa s s' ntfn. \<lbrakk>state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; valid_bound_tcb' (ntfnBoundTCB ntfn) s; is_blocking\<rbrakk> \<Longrightarrow> state_refs_of' s (capNtfnPtr cap) = {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound}
 2. \<And>capa s s' ntfn x3. \<lbrakk>state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB ntfn of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB ntfn) s; is_blocking\<rbrakk> \<Longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ntfn_at' (capNtfnPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) s \<and> sym_refs (\<lambda>a. if a = capNtfnPtr cap then insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound}) else if a = thread then insert (capNtfnPtr cap, TCBSignal) (state_refs_of' s thread) else state_refs_of' s a) \<and> isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) s \<and> thread \<notin> set x3
 3. \<And>capa s s' ntfn. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; valid_obj' (injectKOS ntfn) s\<rbrakk> \<Longrightarrow> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound} proof (prove)
goal (2 subgoals):
 1. \<And>capa s s' ntfn x3. \<lbrakk>state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB ntfn of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB ntfn) s; is_blocking\<rbrakk> \<Longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ntfn_at' (capNtfnPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) s \<and> sym_refs (\<lambda>a. if a = capNtfnPtr cap then insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound}) else if a = thread then insert (capNtfnPtr cap, TCBSignal) (state_refs_of' s thread) else state_refs_of' s a) \<and> isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) s \<and> thread \<notin> set x3
 2. \<And>capa s s' ntfn. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; valid_obj' (injectKOS ntfn) s\<rbrakk> \<Longrightarrow> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound} proof (prove)
goal (2 subgoals):
 1. \<And>capa s s' ntfn list. \<lbrakk>state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; case ntfnBoundTCB ntfn of None \<Rightarrow> True | Some tcb \<Rightarrow> list = [tcb]; valid_bound_tcb' (ntfnBoundTCB ntfn) s; is_blocking\<rbrakk> \<Longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ntfn_at' (capNtfnPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) s \<and> sym_refs (\<lambda>a. if a = capNtfnPtr cap then insert (thread, NTFNSignal) (set list \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound}) else if a = thread then insert (capNtfnPtr cap, TCBSignal) (state_refs_of' s thread) else state_refs_of' s a) \<and> isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) s \<and> thread \<notin> set list
 2. \<And>capa s s' ntfn. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; valid_obj' (injectKOS ntfn) s\<rbrakk> \<Longrightarrow> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound} proof (prove)
goal (3 subgoals):
 1. \<And>capa s s' ntfn list. \<lbrakk>state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; case ntfnBoundTCB ntfn of None \<Rightarrow> True | Some tcb \<Rightarrow> list = [tcb]; valid_bound_tcb' (ntfnBoundTCB ntfn) s; is_blocking; state_refs_of' s (capNtfnPtr cap) = set list \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound} \<and> thread \<notin> set list\<rbrakk> \<Longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> ntfn_at' (capNtfnPtr cap) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) s \<and> sym_refs (\<lambda>a. if a = capNtfnPtr cap then insert (thread, NTFNSignal) (set list \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound}) else if a = thread then insert (capNtfnPtr cap, TCBSignal) (state_refs_of' s thread) else state_refs_of' s a) \<and> isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn \<and> projectKO_opt x = None) (capNtfnPtr cap) s \<and> thread \<notin> set list
 2. \<And>capa s s' ntfn list. \<lbrakk>state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; case ntfnBoundTCB ntfn of None \<Rightarrow> True | Some tcb \<Rightarrow> list = [tcb]; valid_bound_tcb' (ntfnBoundTCB ntfn) s; is_blocking\<rbrakk> \<Longrightarrow> state_refs_of' s (capNtfnPtr cap) = set list \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound} \<and> thread \<notin> set list
 3. \<And>capa s s' ntfn. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; valid_obj' (injectKOS ntfn) s\<rbrakk> \<Longrightarrow> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>state_refs_of' s_ thread = {r \<in> state_refs_of' s_ thread. snd r = TCBBound}; isNotificationCap cap; ccap_relation cap capa_; (s_, s'_) \<in> rf_sr; invs' s_; valid_cap' cap s_; st_tcb_at' simple' thread s_; sch_act_not thread s_; \<forall>d p. thread \<notin> set (ksReadyQueues s_ (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn_ (capNtfnPtr cap) s_; ntfnObj ntfn_ = Structures_H.ntfn.WaitingNtfn list_; list_ \<noteq> []; \<forall>t\<in>set list_. tcb_at' t s_; distinct list_; case ntfnBoundTCB ntfn_ of None \<Rightarrow> True | Some tcb \<Rightarrow> list_ = [tcb]; valid_bound_tcb' (ntfnBoundTCB ntfn_) s_; is_blocking; state_refs_of' s_ (capNtfnPtr cap) = set list_ \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' s_ (capNtfnPtr cap). snd r = NTFNBound} \<and> thread \<notin> set list_\<rbrakk> \<Longrightarrow> tcb_at' thread s_ \<and> Invariants_H.valid_queues s_ \<and> valid_objs' s_ \<and> ntfn_at' (capNtfnPtr cap) s_ \<and> sch_act_wf (ksSchedulerAction s_) s_ \<and> capNtfnPtr cap = capNtfnPtr cap && ~~ mask 4 \<and> valid_pspace' s_ \<and> tcb_at' thread s_ \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) s_ \<and> sym_refs (\<lambda>a. if a = capNtfnPtr cap then insert (thread, NTFNSignal) (set list_ \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' s_ (capNtfnPtr cap). snd r = NTFNBound}) else if a = thread then insert (capNtfnPtr cap, TCBSignal) (state_refs_of' s_ thread) else state_refs_of' s_ a) \<and> isBlockedOnNotification (Structures_H.thread_state.BlockedOnNotification (capNtfnPtr cap)) \<and> ko_wp_at' (\<lambda>x. projectKO_opt x = Some ntfn_ \<and> projectKO_opt x = None) (capNtfnPtr cap) s_ \<and> thread \<notin> set list_ proof (prove)
goal (2 subgoals):
 1. \<And>capa s s' ntfn list. \<lbrakk>state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; case ntfnBoundTCB ntfn of None \<Rightarrow> True | Some tcb \<Rightarrow> list = [tcb]; valid_bound_tcb' (ntfnBoundTCB ntfn) s; is_blocking\<rbrakk> \<Longrightarrow> state_refs_of' s (capNtfnPtr cap) = set list \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound} \<and> thread \<notin> set list
 2. \<And>capa s s' ntfn. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; valid_obj' (injectKOS ntfn) s\<rbrakk> \<Longrightarrow> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound} proof (prove)
goal (2 subgoals):
 1. \<And>capa s s' ntfn list. \<lbrakk>state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; case ntfnBoundTCB ntfn of None \<Rightarrow> True | Some tcb \<Rightarrow> list = [tcb]; valid_bound_tcb' (ntfnBoundTCB ntfn) s; is_blocking; \<exists>obj. obj = ntfn \<and> state_refs_of' s (capNtfnPtr cap) = refs_of' (injectKOS obj) \<and> (\<forall>(x, tp)\<in>refs_of' (injectKOS obj). ko_wp_at' (\<lambda>ko. (capNtfnPtr cap, symreftype tp) \<in> refs_of' ko) x s)\<rbrakk> \<Longrightarrow> state_refs_of' s (capNtfnPtr cap) = set list \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' s (capNtfnPtr cap). snd r = NTFNBound} \<and> thread \<notin> set list
 2. \<And>capa s s' ntfn. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; valid_obj' (injectKOS ntfn) s\<rbrakk> \<Longrightarrow> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound} proof (prove)
goal (2 subgoals):
 1. \<And>capa s s' ntfn list. \<lbrakk>state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; list \<noteq> []; \<forall>t\<in>set list. tcb_at' t s; distinct list; case ntfnBoundTCB ntfn of None \<Rightarrow> True | Some tcb \<Rightarrow> list = [tcb]; valid_bound_tcb' (ntfnBoundTCB ntfn) s; is_blocking; \<exists>obj. obj = ntfn \<and> state_refs_of' s (capNtfnPtr cap) = refs_of' (injectKOS obj) \<and> (\<forall>(x, tp)\<in>refs_of' (injectKOS obj). ko_wp_at' (\<lambda>ko. (capNtfnPtr cap, symreftype tp) \<in> refs_of' ko) x s)\<rbrakk> \<Longrightarrow> thread \<notin> set list
 2. \<And>capa s s' ntfn. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; valid_obj' (injectKOS ntfn) s\<rbrakk> \<Longrightarrow> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound} proof (prove)
goal (2 subgoals):
 1. \<And>capa s s' ntfn list obj. \<lbrakk>state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; list \<noteq> []; \<forall>t\<in>set list. \<exists>ko. ksPSpace s t = Some ko \<and> is_aligned t (objBitsKO ko) \<and> (\<exists>obj. ko = KOTCB obj) \<and> ps_clear t (objBitsKO ko) s; distinct list; case ntfnBoundTCB ntfn of None \<Rightarrow> True | Some tcb \<Rightarrow> list = [tcb]; valid_bound_tcb' (ntfnBoundTCB ntfn) s; is_blocking; ksPSpace s (capNtfnPtr cap) = Some (KONotification ntfn); state_refs_of' s (capNtfnPtr cap) = set list \<times> {NTFNSignal} \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn); \<forall>x\<in>set list \<times> {NTFNSignal} \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn). case x of (x, tp) \<Rightarrow> \<exists>ko. ksPSpace s x = Some ko \<and> is_aligned x (objBitsKO ko) \<and> (capNtfnPtr cap, symreftype tp) \<in> refs_of' ko \<and> ps_clear x (objBitsKO ko) s; ksPSpace s thread = Some (KOTCB obj); is_aligned (capNtfnPtr cap) (objBitsKO (KONotification ntfn)); ps_clear (capNtfnPtr cap) (objBitsKO (KONotification ntfn)) s; is_aligned thread (objBitsKO (KOTCB obj)); simple' (tcbState obj); ps_clear thread (objBitsKO (KOTCB obj)) s; thread \<in> set list\<rbrakk> \<Longrightarrow> False
 2. \<And>capa s s' ntfn. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; valid_obj' (injectKOS ntfn) s\<rbrakk> \<Longrightarrow> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound} proof (prove)
goal (2 subgoals):
 1. \<And>capa s s' ntfn list obj. \<lbrakk>state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; list \<noteq> []; distinct list; case ntfnBoundTCB ntfn of None \<Rightarrow> True | Some tcb \<Rightarrow> list = [tcb]; valid_bound_tcb' (ntfnBoundTCB ntfn) s; is_blocking; ksPSpace s (capNtfnPtr cap) = Some (KONotification ntfn); state_refs_of' s (capNtfnPtr cap) = set list \<times> {NTFNSignal} \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn); \<forall>x\<in>set list \<times> {NTFNSignal} \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn). case x of (x, tp) \<Rightarrow> \<exists>ko. ksPSpace s x = Some ko \<and> is_aligned x (objBitsKO ko) \<and> (capNtfnPtr cap, symreftype tp) \<in> refs_of' ko \<and> ps_clear x (objBitsKO ko) s; ksPSpace s thread = Some (KOTCB obj); is_aligned (capNtfnPtr cap) (objBitsKO (KONotification ntfn)); ps_clear (capNtfnPtr cap) (objBitsKO (KONotification ntfn)) s; is_aligned thread (objBitsKO (KOTCB obj)); simple' (tcbState obj); ps_clear thread (objBitsKO (KOTCB obj)) s; thread \<in> set list; \<exists>ko. ksPSpace s thread = Some ko \<and> is_aligned thread (objBitsKO ko) \<and> (\<exists>obj. ko = KOTCB obj) \<and> ps_clear thread (objBitsKO ko) s\<rbrakk> \<Longrightarrow> False
 2. \<And>capa s s' ntfn. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; valid_obj' (injectKOS ntfn) s\<rbrakk> \<Longrightarrow> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound} proof (prove)
goal (2 subgoals):
 1. \<And>capa s s' ntfn list obj. \<lbrakk>state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; list \<noteq> []; distinct list; case ntfnBoundTCB ntfn of None \<Rightarrow> True | Some tcb \<Rightarrow> list = [tcb]; valid_bound_tcb' (ntfnBoundTCB ntfn) s; is_blocking; ksPSpace s (capNtfnPtr cap) = Some (KONotification ntfn); state_refs_of' s (capNtfnPtr cap) = set list \<times> {NTFNSignal} \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn); ksPSpace s thread = Some (KOTCB obj); is_aligned (capNtfnPtr cap) (objBitsKO (KONotification ntfn)); ps_clear (capNtfnPtr cap) (objBitsKO (KONotification ntfn)) s; is_aligned thread (objBitsKO (KOTCB obj)); simple' (tcbState obj); ps_clear thread (objBitsKO (KOTCB obj)) s; thread \<in> set list; \<exists>ko. ksPSpace s thread = Some ko \<and> is_aligned thread (objBitsKO ko) \<and> (\<exists>obj. ko = KOTCB obj) \<and> ps_clear thread (objBitsKO ko) s; case (thread, NTFNSignal) of (x, tp) \<Rightarrow> \<exists>ko. ksPSpace s x = Some ko \<and> is_aligned x (objBitsKO ko) \<and> (capNtfnPtr cap, symreftype tp) \<in> refs_of' ko \<and> ps_clear x (objBitsKO ko) s\<rbrakk> \<Longrightarrow> False
 2. \<And>capa s s' ntfn. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; valid_obj' (injectKOS ntfn) s\<rbrakk> \<Longrightarrow> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound} proof (prove)
goal (2 subgoals):
 1. \<And>capa s s' ntfn list obj. \<lbrakk>state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound}; isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; list \<noteq> []; distinct list; case ntfnBoundTCB ntfn of None \<Rightarrow> True | Some tcb \<Rightarrow> list = [tcb]; valid_bound_tcb' (ntfnBoundTCB ntfn) s; is_blocking; ksPSpace s (capNtfnPtr cap) = Some (KONotification ntfn); state_refs_of' s (capNtfnPtr cap) = set list \<times> {NTFNSignal} \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn); ksPSpace s thread = Some (KOTCB obj); is_aligned (capNtfnPtr cap) (objBitsKO (KONotification ntfn)); ps_clear (capNtfnPtr cap) (objBitsKO (KONotification ntfn)) s; is_aligned thread (objBitsKO (KOTCB obj)); simple' (tcbState obj); ps_clear thread (objBitsKO (KOTCB obj)) s; thread \<in> set list; (capNtfnPtr cap, TCBSignal) \<in> tcb_st_refs_of' (tcbState obj)\<rbrakk> \<Longrightarrow> False
 2. \<And>capa s s' ntfn. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; valid_obj' (injectKOS ntfn) s\<rbrakk> \<Longrightarrow> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound} proof (prove)
goal (1 subgoal):
 1. \<And>capa s s' ntfn. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; valid_obj' (injectKOS ntfn) s\<rbrakk> \<Longrightarrow> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound} proof (prove)
goal (1 subgoal):
 1. \<And>capa s s' ntfn. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; st_tcb_at' simple' thread s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; ko_at' ntfn (capNtfnPtr cap) s; valid_obj' (KONotification ntfn) s\<rbrakk> \<Longrightarrow> state_refs_of' s thread = {r \<in> state_refs_of' s thread. snd r = TCBBound} proof (prove)
goal (1 subgoal):
 1. \<And>capa s s' ntfn obj. \<lbrakk>isNotificationCap cap; ccap_relation cap capa; (s, s') \<in> rf_sr; invs' s; valid_cap' cap s; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); capNtfnPtr cap \<noteq> thread; valid_obj' (KONotification ntfn) s; ksPSpace s (capNtfnPtr cap) = Some (KONotification ntfn); ksPSpace s thread = Some (KOTCB obj); is_aligned (capNtfnPtr cap) (objBitsKO (KONotification ntfn)); ps_clear (capNtfnPtr cap) (objBitsKO (KONotification ntfn)) s; is_aligned thread (objBitsKO (KOTCB obj)); simple' (tcbState obj); ps_clear thread (objBitsKO (KOTCB obj)) s\<rbrakk> \<Longrightarrow> tcb_st_refs_of' (tcbState obj) \<union> tcb_bound_refs' (tcbBoundNotification obj) = tcb_bound_refs' (tcbBoundNotification obj) proof (prove)
goal:
No subgoals!