theory Tcb_C

lemma decodeBindNotification_ccorres:
  "interpret_excaps extraCaps' = excaps_map extraCaps \<Longrightarrow>
   ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_')
       (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple
              and valid_cap' cp
              and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp)
              and (\<lambda>s. \<forall>rf \<in> zobj_refs' cp. ex_nonz_cap_to' rf s)
              and (\<lambda>s. \<forall>v \<in> set extraCaps. \<forall>y \<in> zobj_refs' (fst v). ex_nonz_cap_to' y s )
              and (excaps_in_mem extraCaps o ctes_of)
              and K (isThreadCap cp))
       (UNIV \<inter> {s. ccap_relation cp (cap_' s)}
             \<inter> {s. current_extra_caps_' (globals s) = extraCaps'}) []
     (decodeBindNotification cp extraCaps >>= invocationCatch thread isBlocking isCall InvokeTCB)
     (Call decodeBindNotification_'proc)" apply (simp, rule ccorres_gen_asm) apply (cinit' lift: cap_' current_extra_caps_' simp: decodeBindNotification_def) apply (simp add: bind_assoc whenE_def bind_bindE_assoc interpret_excaps_test_null
               del: Collect_const cong: call_ignore_cong) apply (rule ccorres_Cond_rhs_Seq) apply (simp add: excaps_map_def invocationCatch_def throwError_bind null_def
               cong: StateSpace.state.fold_congs globals.fold_congs) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply (simp add: excaps_map_def null_def del: Collect_const cong: call_ignore_cong) apply csymbr apply csymbr apply (rule ccorres_Guard_Seq) apply (simp add: liftE_bindE bind_assoc cong: call_ignore_cong) apply (rule ccorres_pre_getBoundNotification) apply (rule_tac P="\<lambda>s. rv \<noteq> Some 0" in ccorres_cross_over_guard) apply (simp add: bindE_bind_linearise cong: call_ignore_cong) apply wpc prefer 2 apply (simp add: bindE_bind_linearise[symmetric] injection_handler_throwError
                     invocationCatch_use_injection_handler throwError_bind invocationCatch_def) apply (rule ccorres_cond_true_seq) apply (rule ccorres_from_vcg_split_throws[where P=\<top> and P'=UNIV]) apply vcg apply (rule conseqPre, vcg) apply (clarsimp simp: throwError_def return_def syscall_error_rel_def syscall_error_to_H_cases
                          exception_defs) apply (simp add: returnOk_bind ccorres_invocationCatch_Inr performInvocation_def
                    bindE_bind_linearise[symmetric] cong: call_ignore_cong) apply (rule ccorres_cond_false_seq) apply (simp cong: call_ignore_cong) apply (rule getSlotCap_ccorres_fudge_n[where vals=extraCaps and n=0]) apply (rule ccorres_move_c_guard_cte) apply ctac apply csymbr apply (simp add: cap_get_tag_isCap if_1_0_0 del: Collect_const cong: call_ignore_cong) apply (rule ccorres_assert2) apply (rule ccorres_Cond_rhs_Seq) apply (rule_tac P="Q (capNtfnPtr rva) (capNtfnCanReceive rva) rva"for Q in ccorres_inst) apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply (simp add: hd_conv_nth del: Collect_const cong: call_ignore_cong) apply (simp only: cap_get_tag_isCap(3)[symmetric] cong: call_ignore_cong, frule(1) cap_get_tag_to_H(3) ) apply (simp add: case_bool_If if_to_top_of_bindE if_to_top_of_bind bind_assoc
                  del: Collect_const cong: if_cong call_ignore_cong) apply csymbr apply (clarsimp simp add: if_to_top_of_bind to_bool_eq_0[symmetric] simp del: Collect_const) apply (rule ccorres_Cond_rhs_Seq) apply (clarsimp simp: throwError_bind invocationCatch_def) apply (rule ccorres_from_vcg_split_throws[where P=\<top> and P'=UNIV]) apply vcg apply (rule conseqPre, vcg) apply (clarsimp simp: throwError_def return_def syscall_error_rel_def syscall_error_to_H_cases exception_defs) apply (clarsimp simp: to_bool_def) apply (rule ccorres_pre_getNotification) apply (rename_tac ntfn) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (rule_tac xf'="ret__int_'" and val="from_bool (ntfnBoundTCB ntfn \<noteq> None \<or>
                                                    isWaitingNtfn (ntfnObj ntfn))"
                                       and R="ko_at' ntfn (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))
                                                  and valid_ntfn' ntfn"
                                       and R'=UNIV
                                  in  ccorres_symb_exec_r_known_rv_UNIV) apply (rule conseqPre, vcg) apply (clarsimp simp: if_1_0_0) apply (erule cmap_relationE1[OF cmap_relation_ntfn], erule ko_at_projectKO_opt) apply (clarsimp simp: typ_heap_simps cnotification_relation_def Let_def
                               valid_ntfn'_def) apply (case_tac "ntfnObj ntfn", simp_all add: isWaitingNtfn_def option_to_ctcb_ptr_def
                                                split: option.split_asm if_split,
                         auto simp: neq_Nil_conv tcb_queue_relation'_def tcb_at_not_NULL[symmetric]
                                    tcb_at_not_NULL)[1] apply ceqv apply (rule_tac P="\<lambda>s. ksCurThread s = thread" in ccorres_cross_over_guard) apply (simp add: bindE_bind_linearise del: Collect_const) apply wpc
         \<comment> \<open>IdleNtfn\<close> apply (simp add: case_option_If del: Collect_const) apply (rule ccorres_Cond_rhs_Seq) apply (clarsimp simp: isWaitingNtfn_def from_bool_neq_0) apply (simp add: bindE_bind_linearise[symmetric] injection_handler_throwError
                           invocationCatch_use_injection_handler throwError_bind invocationCatch_def) apply (rule ccorres_from_vcg_split_throws[where P=\<top> and P'=UNIV]) apply vcg apply (rule conseqPre, vcg) apply (clarsimp simp: throwError_def return_def syscall_error_rel_def
                                syscall_error_to_H_cases exception_defs) apply (clarsimp simp: isWaitingNtfn_def from_bool_neq_0 returnOk_bind) apply (clarsimp simp: isWaitingNtfn_def from_bool_neq_0 returnOk_bind
                               ccorres_invocationCatch_Inr performInvocation_def) apply (ctac add: setThreadState_ccorres) apply (ctac add: invokeTCB_NotificationControl_bind_ccorres) apply simp apply (rule ccorres_alternative2) apply (rule ccorres_return_CE, simp+)[1] apply (rule ccorres_return_C_errorE, simp+)[1] apply wp apply (vcg exspec=invokeTCB_NotificationControl_modifies) apply simp apply (wp sts_invs_minor' hoare_case_option_wp sts_bound_tcb_at' | wpc | simp)+ apply (vcg exspec=setThreadState_modifies) apply (simp add: case_option_If del: Collect_const) apply (rule ccorres_Cond_rhs_Seq) apply (clarsimp simp: isWaitingNtfn_def from_bool_neq_0) apply (simp add: bindE_bind_linearise[symmetric] injection_handler_throwError
                          invocationCatch_use_injection_handler throwError_bind invocationCatch_def) apply (rule ccorres_from_vcg_split_throws[where P=\<top> and P'=UNIV]) apply vcg apply (rule conseqPre, vcg) apply (clarsimp simp: throwError_def return_def syscall_error_rel_def
                               syscall_error_to_H_cases exception_defs) apply (clarsimp simp: isWaitingNtfn_def from_bool_neq_0 returnOk_bind) apply (clarsimp simp: isWaitingNtfn_def from_bool_neq_0 returnOk_bind
                              ccorres_invocationCatch_Inr performInvocation_def) apply (ctac add: setThreadState_ccorres) apply (ctac add: invokeTCB_NotificationControl_bind_ccorres) apply simp apply (rule ccorres_alternative2) apply (rule ccorres_return_CE, simp+)[1] apply (rule ccorres_return_C_errorE, simp+)[1] apply wp apply (vcg exspec=invokeTCB_NotificationControl_modifies) apply simp apply (wp sts_invs_minor' hoare_case_option_wp sts_bound_tcb_at' | wpc | simp)+ apply (vcg exspec=setThreadState_modifies) apply (simp add: bindE_bind_linearise[symmetric] injection_handler_throwError
                        invocationCatch_use_injection_handler throwError_bind invocationCatch_def) apply (rule ccorres_cond_true_seq) apply (rule ccorres_from_vcg_split_throws[where P=\<top> and P'=UNIV]) apply vcg apply (rule conseqPre, vcg) apply (clarsimp simp: throwError_def return_def syscall_error_rel_def
                             syscall_error_to_H_cases exception_defs) apply (clarsimp simp add: guard_is_UNIV_def isWaitingNtfn_def
                                ThreadState_Restart_def mask_def
                                rf_sr_ksCurThread capTCBPtr_eq) apply (simp add: hd_conv_nth bindE_bind_linearise nTFN_case_If_ptr throwError_bind invocationCatch_def) apply (rule ccorres_from_vcg_split_throws[where P=\<top> and P'=UNIV]) apply vcg apply (rule conseqPre, vcg) apply (clarsimp simp: throwError_def return_def syscall_error_rel_def syscall_error_to_H_cases
                           exception_defs) apply clarsimp apply (wp | simp | wpc | wp (once) hoare_drop_imps)+ apply vcg apply clarsimp apply (rule conjI) apply safe[1] apply (fastforce simp: invs'_def valid_state'_def valid_pspace'_def
                                  dest!: valid_objs_boundNTFN_NULL) apply ((fastforce elim!: pred_tcb'_weakenE obj_at'_weakenE
                                    simp: ct_in_state'_def from_bool_0 isCap_simps excaps_map_def
                                          neq_Nil_conv obj_at'_def pred_tcb_at'_def valid_tcb_state'_def)+)[12] apply (clarsimp dest!: obj_at_valid_objs'[OF _ invs_valid_objs']
                      simp: projectKOs valid_obj'_def) apply (clarsimp simp: excaps_map_Nil cte_wp_at_ctes_of excaps_map_def neq_Nil_conv
                   dest!: interpret_excaps_eq ) apply (clarsimp simp: excaps_map_Nil) apply (frule obj_at_ko_at', clarsimp) apply (rule cmap_relationE1[OF cmap_relation_tcb], assumption) apply (erule ko_at_projectKO_opt) apply (clarsimp simp: isCap_simps) apply (frule cap_get_tag_isCap_unfolded_H_cap) apply safe[1] apply (clarsimp simp: typ_heap_simps excaps_map_def neq_Nil_conv
                        dest!: interpret_excaps_eq) apply clarsimp apply (frule cap_get_tag_isCap_unfolded_H_cap(3)) apply (clarsimp simp: typ_heap_simps cap_get_tag_ThreadCap ccap_relation_def) apply (auto simp: word_sless_alt typ_heap_simps cap_get_tag_ThreadCap ctcb_relation_def
                         option_to_ptr_def option_to_0_def
                  split: if_split) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. interpret_excaps extraCaps' = excaps_map extraCaps \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of and K (isThreadCap cp)) (UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = extraCaps'\<rbrace>) [] (decodeBindNotification cp extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (Call decodeBindNotification_'proc) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) (\<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = extraCaps'\<rbrace>) [] (decodeBindNotification cp extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (Call decodeBindNotification_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>current_extra_caps cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2141 current_extra_caps cap) (?Q'2141 current_extra_caps cap) [SKIP] (doE y <- whenE (null extraCaps) (throwError Fault_H.syscall_error.TruncatedMessage);
ntfn <- liftE (getBoundNotification (capTCBPtr cp));
y <- case ntfn of None \<Rightarrow> returnOk () | Some v11 \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(ntfnPtr, rights) <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
y <- whenE (\<not> rights) (throwError Fault_H.syscall_error.IllegalOperation);
notification <- liftE (getNotification ntfnPtr);
y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF excaprefs_C current_extra_caps.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>tcb\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(\<acute>tcb,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 2. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ?Q2141 current_extra_caps cap s \<and> s' \<in> ?Q'2141 current_extra_caps cap proof (prove)
goal (2 subgoals):
 1. \<And>current_extra_caps cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2141 extraCaps' cap) (?Q'2141 extraCaps' cap) [SKIP] (doE y <- if null extraCaps then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
ntfn <- liftE (getBoundNotification (capTCBPtr cp));
y <- case ntfn of None \<Rightarrow> returnOk () | Some v11 \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(ntfnPtr, rights) <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
notification <- liftE (getNotification ntfnPtr);
y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF excaps_map extraCaps = [] THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>tcb\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(\<acute>tcb,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 2. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ?Q2141 current_extra_caps cap s \<and> s' \<in> ?Q'2141 current_extra_caps cap proof (prove)
goal (3 subgoals):
 1. \<And>current_extra_caps cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; excaps_map extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2152 extraCaps' cap) (?S2155 extraCaps' cap) [SKIP] (doE y <- if null extraCaps then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
ntfn <- liftE (getBoundNotification (capTCBPtr cp));
y <- case ntfn of None \<Rightarrow> returnOk () | Some v11 \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(ntfnPtr, rights) <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
notification <- liftE (getNotification ntfnPtr);
y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>tcb\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(\<acute>tcb,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 2. \<And>current_extra_caps cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; excaps_map extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2151 extraCaps' cap) (?T2153 extraCaps' cap) [SKIP] (doE y <- if null extraCaps then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
ntfn <- liftE (getBoundNotification (capTCBPtr cp));
y <- case ntfn of None \<Rightarrow> returnOk () | Some v11 \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(ntfnPtr, rights) <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
notification <- liftE (getNotification ntfnPtr);
y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>tcb\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(\<acute>tcb,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 3. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> ?Q2152 current_extra_caps cap s) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> ?R2151 current_extra_caps cap s)) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> ?S2155 current_extra_caps cap) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> ?T2153 current_extra_caps cap)} proof (prove)
goal (3 subgoals):
 1. \<And>current_extra_caps cap. \<lbrakk>interpret_excaps extraCaps' = []; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2152 extraCaps' cap) (?S2155 extraCaps' cap) [SKIP] (throwError (Inl Fault_H.syscall_error.TruncatedMessage)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>tcb\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc();;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 2. \<And>current_extra_caps cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; excaps_map extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2151 extraCaps' cap) (?T2153 extraCaps' cap) [SKIP] (doE y <- if null extraCaps then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
ntfn <- liftE (getBoundNotification (capTCBPtr cp));
y <- case ntfn of None \<Rightarrow> returnOk () | Some v11 \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(ntfnPtr, rights) <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
notification <- liftE (getNotification ntfnPtr);
y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>tcb\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(\<acute>tcb,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 3. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> ?Q2152 current_extra_caps cap s) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> ?R2151 current_extra_caps cap s)) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> ?S2155 current_extra_caps cap) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> ?T2153 current_extra_caps cap)} proof (prove)
goal (3 subgoals):
 1. \<And>current_extra_caps cap err' ft'. \<lbrakk>interpret_excaps extraCaps' = []; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps = []\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) err') ft' = Some Fault_H.syscall_error.TruncatedMessage
 2. \<And>current_extra_caps cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; excaps_map extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2151 extraCaps' cap) (?T2153 extraCaps' cap) [SKIP] (doE y <- if null extraCaps then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
ntfn <- liftE (getBoundNotification (capTCBPtr cp));
y <- case ntfn of None \<Rightarrow> returnOk () | Some v11 \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(ntfnPtr, rights) <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
notification <- liftE (getNotification ntfnPtr);
y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>tcb\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(\<acute>tcb,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 3. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> ?R2151 current_extra_caps cap s)) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> ?T2153 current_extra_caps cap)} proof (prove)
goal (2 subgoals):
 1. \<And>current_extra_caps cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; excaps_map extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2151 extraCaps' cap) (?T2153 extraCaps' cap) [SKIP] (doE y <- if null extraCaps then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
ntfn <- liftE (getBoundNotification (capTCBPtr cp));
y <- case ntfn of None \<Rightarrow> returnOk () | Some v11 \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(ntfnPtr, rights) <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
notification <- liftE (getNotification ntfnPtr);
y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>tcb\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(\<acute>tcb,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 2. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> ?R2151 current_extra_caps cap s)) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> ?T2153 current_extra_caps cap)} proof (prove)
goal (2 subgoals):
 1. \<And>current_extra_caps cap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2151 extraCaps' cap) (?T2153 extraCaps' cap) [SKIP] (doE ntfn <- liftE (getBoundNotification (capTCBPtr cp));
y <- case ntfn of None \<Rightarrow> returnOk () | Some v11 \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(ntfnPtr, rights) <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
notification <- liftE (getNotification ntfnPtr);
y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>tcb :== tcb_Ptr \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>tcb\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(\<acute>tcb,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 2. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> ?R2151 current_extra_caps cap s)) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> ?T2153 current_extra_caps cap)} proof (prove)
goal (2 subgoals):
 1. \<And>current_extra_caps cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2151 extraCaps' cap) (?G'2180 extraCaps' cap ret__unsigned) [SKIP] (doE ntfn <- liftE (getBoundNotification (capTCBPtr cp));
y <- case ntfn of None \<Rightarrow> returnOk () | Some v11 \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(ntfnPtr, rights) <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
notification <- liftE (getNotification ntfnPtr);
y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>tcb :== tcb_Ptr ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(\<acute>tcb\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(\<acute>tcb,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 2. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> ?R2151 current_extra_caps cap s)) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> ?G'2180 current_extra_caps cap v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})} proof (prove)
goal (2 subgoals):
 1. \<And>current_extra_caps cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2151 extraCaps' cap) (?G'2401 extraCaps' cap ret__unsigned) [SKIP] (doE ntfn <- liftE (getBoundNotification (capTCBPtr cp));
y <- case ntfn of None \<Rightarrow> returnOk () | Some v11 \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(ntfnPtr, rights) <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
notification <- liftE (getNotification ntfnPtr);
y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_Ptr ret__unsigned} (IF h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigned,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 2. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> ?R2151 current_extra_caps cap s)) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> ?G'2401 current_extra_caps cap v}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})} proof (prove)
goal (2 subgoals):
 1. \<And>current_extra_caps cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2151 extraCaps' cap) (?C'2921 extraCaps' cap ret__unsigned) [SKIP] (doE ntfn <- liftE (getBoundNotification (capTCBPtr cp));
y <- case ntfn of None \<Rightarrow> returnOk () | Some v11 \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(ntfnPtr, rights) <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
notification <- liftE (getNotification ntfnPtr);
y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr ret__unsigned\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigned,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 2. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> ?R2151 current_extra_caps cap s)) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> ?C'2921 current_extra_caps cap v \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})} proof (prove)
goal (2 subgoals):
 1. \<And>current_extra_caps cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2151 extraCaps' cap) (?C'2921 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) [SKIP] (do ntfn <- getBoundNotification (capTCBPtr cp);
doE y <- case ntfn of None \<Rightarrow> returnOk () | Some v11 \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(ntfnPtr, rights) <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigned,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 2. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> ?R2151 current_extra_caps cap s)) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> ?C'2921 current_extra_caps cap v \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})} proof (prove)
goal (2 subgoals):
 1. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P2933 cap rv) (?P'2932 cap rv) [SKIP] (doE y <- case rv of None \<Rightarrow> returnOk () | Some v11 \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigned,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 2. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ?P2930 current_extra_caps cap s tcb))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> ?P'2931 current_extra_caps cap v tcb} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap s tcb. ?P2933 cap (tcbBoundNotification tcb) s \<equiv>\<^sup>? ?P2930 extraCaps'
\<lambda>cap tcb. ?P'2932 cap (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>cap. ?P'2931 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) proof (prove)
goal (2 subgoals):
 1. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P'2945 cap rv) (?Q2942 cap rv) [SKIP] (doE y <- case rv of None \<Rightarrow> returnOk () | Some v11 \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigned,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 2. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and ?P'2946 current_extra_caps cap tcb) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> ?Q2943 current_extra_caps cap v tcb}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap tcb. ?P'2945 cap (tcbBoundNotification tcb) \<equiv>\<^sup>? ?P'2946 extraCaps'
\<lambda>cap tcb. ?Q2942 cap (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>cap. ?Q2943 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) proof (prove)
goal (2 subgoals):
 1. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P'2945 cap rv) (?Q2942 cap rv) [SKIP] ((case rv of None \<Rightarrow> returnOk () | Some v11 \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= case_sum (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) (\<lambda>rv. (case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= case_sum (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) (\<lambda>rv. (case rv of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB))) (IF h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigned,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 2. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and ?P'2946 current_extra_caps cap tcb) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> ?Q2943 current_extra_caps cap v tcb}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap tcb. ?P'2945 cap (tcbBoundNotification tcb) \<equiv>\<^sup>? ?P'2946 extraCaps'
\<lambda>cap tcb. ?Q2942 cap (tcbBoundNotification tcb) \<equiv>\<^sup>? \<lambda>cap. ?Q2943 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) proof (prove)
goal (3 subgoals):
 1. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2977 cap rv) (?R''2973 cap rv) [SKIP] (do a <- returnOk ();
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> do a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> (case rv of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od
od) (IF h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigned,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 2. \<And>current_extra_caps cap ret__unsigned rv x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = Some x2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R2976 cap rv a x2) (?R''2971 cap rv x2) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> do a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> (case rv of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od
od) (IF h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigned,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 3. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ?R2969 current_extra_caps cap tcb a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> ?R2968 current_extra_caps cap tcb a x))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> ?R''2975 current_extra_caps cap v tcb} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> ?R''2974 current_extra_caps cap v tcb x}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap tcb. ?R2977 cap (tcbBoundNotification tcb) \<equiv>\<^sup>? ?R2969 extraCaps'
\<lambda>cap tcb. ?R2976 cap (tcbBoundNotification tcb) \<equiv>\<^sup>? ?R2968 extraCaps'
\<lambda>cap. ?R''2975 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R''2973 cap (tcbBoundNotification tcb)
\<lambda>cap. ?R''2974 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R''2971 cap (tcbBoundNotification tcb) proof (prove)
goal (3 subgoals):
 1. \<And>current_extra_caps cap ret__unsigned rv x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = Some x2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R2976 cap rv a x2) (?R''2971 cap rv x2) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> do a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> (case rv of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od
od) (IF h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigned,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 2. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2977 cap rv) (?R''2973 cap rv) [SKIP] (do a <- returnOk ();
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> do a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> (case rv of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od
od) (IF h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigned,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 3. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ?R2969 current_extra_caps cap tcb a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> ?R2968 current_extra_caps cap tcb a x))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> ?R''2975 current_extra_caps cap v tcb} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> ?R''2974 current_extra_caps cap v tcb x}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap tcb. ?R2977 cap (tcbBoundNotification tcb) \<equiv>\<^sup>? ?R2969 extraCaps'
\<lambda>cap tcb. ?R2976 cap (tcbBoundNotification tcb) \<equiv>\<^sup>? ?R2968 extraCaps'
\<lambda>cap. ?R''2975 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R''2973 cap (tcbBoundNotification tcb)
\<lambda>cap. ?R''2974 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R''2971 cap (tcbBoundNotification tcb) proof (prove)
goal (3 subgoals):
 1. \<And>current_extra_caps cap ret__unsigned rv x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = Some x2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R2976 cap (Some x2) a x2) (?R''2971 cap (Some x2) x2) [SKIP] (throwError (Inl Fault_H.syscall_error.IllegalOperation)) (IF h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 2. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2977 cap rv) (?R''2973 cap rv) [SKIP] (do a <- returnOk ();
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> do a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> (case rv of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od
od) (IF h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigned,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 3. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ?R2969 current_extra_caps cap tcb a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> ?R2968 current_extra_caps cap tcb a x))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> ?R''2975 current_extra_caps cap v tcb} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> ?R''2974 current_extra_caps cap v tcb x}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap tcb. ?R2977 cap (tcbBoundNotification tcb) \<equiv>\<^sup>? ?R2969 extraCaps'
\<lambda>cap tcb. ?R2976 cap (tcbBoundNotification tcb) \<equiv>\<^sup>? ?R2968 extraCaps'
\<lambda>cap. ?R''2975 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R''2973 cap (tcbBoundNotification tcb)
\<lambda>cap. ?R''2974 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R''2971 cap (tcbBoundNotification tcb) proof (prove)
goal (3 subgoals):
 1. \<And>current_extra_caps cap ret__unsigned rv x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = Some x2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R2990 cap (Some x2) a x2) (?R'2984 cap (Some x2) x2) [SKIP] (throwError (Inl Fault_H.syscall_error.IllegalOperation)) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 2. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2977 cap rv) (?R''2973 cap rv) [SKIP] (do a <- returnOk ();
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> do a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> (case rv of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od
od) (IF h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigned,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 3. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ?R2969 current_extra_caps cap tcb a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> ?R2968 current_extra_caps cap tcb a x))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> ?R''2975 current_extra_caps cap v tcb} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> ?R'2985 current_extra_caps cap v tcb x \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R'2985 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'2984 cap (tcbBoundNotification tcb)
\<lambda>cap tcb. ?R2977 cap (tcbBoundNotification tcb) \<equiv>\<^sup>? ?R2969 extraCaps'
\<lambda>cap tcb. ?R2990 cap (tcbBoundNotification tcb) \<equiv>\<^sup>? ?R2968 extraCaps'
\<lambda>cap. ?R''2975 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R''2973 cap (tcbBoundNotification tcb) proof (prove)
goal (4 subgoals):
 1. \<And>current_extra_caps cap ret__unsigned rv x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2992 cap (Some x2) x2) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 2. \<And>current_extra_caps cap ret__unsigned rv x2 \<sigma>. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (throwError (Inl Fault_H.syscall_error.IllegalOperation) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 3. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2977 cap rv) (?R''2973 cap rv) [SKIP] (do a <- returnOk ();
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> do a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> (case rv of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od
od) (IF h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigned,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 4. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ?R2969 current_extra_caps cap tcb a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> ?R''2975 current_extra_caps cap v tcb} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> ?R'2993 current_extra_caps cap v tcb x \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R'2993 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'2992 cap (tcbBoundNotification tcb)
\<lambda>cap tcb. ?R2977 cap (tcbBoundNotification tcb) \<equiv>\<^sup>? ?R2969 extraCaps'
\<lambda>cap. ?R''2975 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R''2973 cap (tcbBoundNotification tcb) proof (prove)
goal (3 subgoals):
 1. \<And>current_extra_caps cap ret__unsigned rv x2 \<sigma>. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (throwError (Inl Fault_H.syscall_error.IllegalOperation) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2977 cap rv) (?R''2973 cap rv) [SKIP] (do a <- returnOk ();
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> do a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> (case rv of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od
od) (IF h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigned,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 3. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ?R2969 current_extra_caps cap tcb a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> ?R''2975 current_extra_caps cap v tcb} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap tcb. ?R2977 cap (tcbBoundNotification tcb) \<equiv>\<^sup>? ?R2969 extraCaps'
\<lambda>cap. ?R''2975 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R''2973 cap (tcbBoundNotification tcb) proof (prove)
goal (3 subgoals):
 1. \<And>current_extra_caps cap ret__unsigned rv x2 \<sigma>. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = Some x2\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (throwError (Inl Fault_H.syscall_error.IllegalOperation) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))}
 2. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2977 cap rv) (?R''2973 cap rv) [SKIP] (do a <- returnOk ();
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> do a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> (case rv of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od
od) (IF h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigned,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 3. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ?R2969 current_extra_caps cap tcb a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> ?R''2975 current_extra_caps cap v tcb} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap tcb. ?R2977 cap (tcbBoundNotification tcb) \<equiv>\<^sup>? ?R2969 extraCaps'
\<lambda>cap. ?R''2975 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R''2973 cap (tcbBoundNotification tcb) proof (prove)
goal (2 subgoals):
 1. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2977 cap rv) (?R''2973 cap rv) [SKIP] (do a <- returnOk ();
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> do a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> (case rv of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od
od) (IF h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigned,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 2. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ?R2969 current_extra_caps cap tcb a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> ?R''2975 current_extra_caps cap v tcb} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap tcb. ?R2977 cap (tcbBoundNotification tcb) \<equiv>\<^sup>? ?R2969 extraCaps'
\<lambda>cap. ?R''2975 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R''2973 cap (tcbBoundNotification tcb) proof (prove)
goal (2 subgoals):
 1. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2977 cap None) (?R''2973 cap None) [SKIP] (doE rv <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case rv of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigned,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 2. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ?R2969 current_extra_caps cap tcb a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> ?R''2975 current_extra_caps cap v tcb} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap tcb. ?R2977 cap (tcbBoundNotification tcb) \<equiv>\<^sup>? ?R2969 extraCaps'
\<lambda>cap. ?R''2975 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R''2973 cap (tcbBoundNotification tcb) proof (prove)
goal (2 subgoals):
 1. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2977 cap None) (?R'3017 cap None) [SKIP] (doE rv <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case rv of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigned,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 2. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ?R2969 current_extra_caps cap tcb a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> ?R'3018 current_extra_caps cap v tcb \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R'3018 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3017 cap (tcbBoundNotification tcb)
\<lambda>cap tcb. ?R2977 cap (tcbBoundNotification tcb) \<equiv>\<^sup>? ?R2969 extraCaps' proof (prove)
goal (2 subgoals):
 1. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2977 cap None) (?R'3017 cap None) [SKIP] (doE (ntfnPtr, rights) <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigned,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 2. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ?R2969 current_extra_caps cap tcb a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> ?R'3018 current_extra_caps cap v tcb \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R'3018 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3017 cap (tcbBoundNotification tcb)
\<lambda>cap tcb. ?R2977 cap (tcbBoundNotification tcb) \<equiv>\<^sup>? ?R2969 extraCaps' proof (prove)
goal (2 subgoals):
 1. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P3030 cap None) (?R'3017 cap None) [SKIP] (do rv <- getSlotCap (snd (extraCaps ! 0));
_ <- assert (rv = fst (extraCaps ! 0));
doE (ntfnPtr, rights) <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigned,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 2. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ?P3032 current_extra_caps cap tcb s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> ?R'3018 current_extra_caps cap v tcb \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
?P3032 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?P3030 cap (tcbBoundNotification tcb)
\<lambda>cap. ?R'3018 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3017 cap (tcbBoundNotification tcb) proof (prove)
goal (2 subgoals):
 1. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A3040 cap None) (?C'3035 cap None) [SKIP] (do rv <- getSlotCap (snd (extraCaps ! 0));
_ <- assert (rv = fst (extraCaps ! 0));
doE (ntfnPtr, rights) <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(\<acute>ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigned,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 2. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> (?A3042 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> ?C'3038 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?C'3038 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?C'3035 cap (tcbBoundNotification tcb)
?A3042 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?A3040 cap (tcbBoundNotification tcb) proof (prove)
goal (4 subgoals):
 1. \<And>current_extra_caps cap ret__unsigned rv rva ntfn_cap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3048 current_extra_caps cap ret__unsigned rv rva) (?Q'3048 current_extra_caps cap ret__unsigned rv rva ntfn_cap) [SKIP] (do _ <- assert (rva = fst (extraCaps ! 0));
doE (ntfnPtr, rights) <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigned,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 2. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>?Q3048 current_extra_caps cap ret__unsigned rv\<rbrace>
 3. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> ?Q'3048 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s)}
 4. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (4 subgoals):
 1. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3048 current_extra_caps cap ret__unsigneda rv rva) (?G'3611 current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned) [SKIP] (do _ <- assert (rva = fst (extraCaps ! 0));
doE (ntfnPtr, rights) <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 2. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>?Q3048 current_extra_caps cap ret__unsigned rv\<rbrace>
 3. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'3611 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v}}
 4. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (4 subgoals):
 1. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3048 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?G'3611 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (do _ <- assert (rva = fst (extraCaps ! 0));
doE (ntfnPtr, rights) <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF isNotificationCap rva THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 2. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>?Q3048 current_extra_caps cap ret__unsigned rv\<rbrace>
 3. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'3611 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v}}
 4. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (4 subgoals):
 1. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G3799 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?G'3800 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF isNotificationCap rva THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 2. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> ?G3799 current_extra_caps cap ret__unsigned rv a b\<rbrace>
 3. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> ?G'3800 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v}}}
 4. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (5 subgoals):
 1. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3808 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?S3811 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 2. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 3. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> ?Q3808 current_extra_caps cap ret__unsigned rv a b) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 4. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> ?S3811 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 5. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (5 subgoals):
 1. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3822 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva) (?S3811 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(ntfn_cap);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 2. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 3. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> ?Q3808 current_extra_caps cap ret__unsigned rv a b) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 4. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> ?S3811 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 5. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap rva. ?Q3822 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?Q3808 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (5 subgoals):
 1. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3822 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva) (?S3811 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(ntfn_cap);;
(\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 2. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 3. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> ?Q3808 current_extra_caps cap ret__unsigned rv a b) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 4. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> ?S3811 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 5. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap rva. ?Q3822 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?Q3808 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (5 subgoals):
 1. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsignedb ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsignedb = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); isNotificationCap rva; ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3822 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva) (?G'3839 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap) ret__unsigned) [SKIP] (doE (ntfnPtr, rights) <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ntfnPtr :== ntfn_Ptr ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 2. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 3. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> ?Q3808 current_extra_caps cap ret__unsigned rv a b) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 4. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> ?G'3839 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v va}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 5. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap rva. ?Q3822 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?Q3808 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (5 subgoals):
 1. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsignedb ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsignedb = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); isNotificationCap rva; ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3822 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva) (?G'3986 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap) ret__unsigned) [SKIP] (doE (ntfnPtr, rights) <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfn_Ptr ret__unsigned);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfn_Ptr ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,ntfn_Ptr ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 2. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 3. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> ?Q3808 current_extra_caps cap ret__unsigned rv a b) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 4. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> ?G'3986 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 5. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap rva. ?Q3822 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?Q3808 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (5 subgoals):
 1. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsignedb ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation (fst (extraCaps ! 0)) ntfn_cap; ret__unsignedb = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3822 cap (fst (extraCaps ! 0)) (capNtfnPtr (fst (extraCaps ! 0))) (capNtfnCanReceive (fst (extraCaps ! 0))) (fst (extraCaps ! 0))) (?G'3986 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None (fst (extraCaps ! 0)) ntfn_cap (cap_get_tag ntfn_cap) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) [SKIP] (doE (ntfnPtr, rights) <- case fst (extraCaps ! 0) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfn_Ptr ret__unsigned);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfn_Ptr ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,ntfn_Ptr ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 2. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 3. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> ?Q3808 current_extra_caps cap ret__unsigned rv a b) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 4. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> ?G'3986 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 5. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap rva. ?Q3822 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?Q3808 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (5 subgoals):
 1. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsignedb ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation (fst (extraCaps ! 0)) ntfn_cap; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; rva = fst (extraCaps ! 0); cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap); fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3822 cap (fst (extraCaps ! 0)) (capNtfnPtr (fst (extraCaps ! 0))) (capNtfnCanReceive (fst (extraCaps ! 0))) (fst (extraCaps ! 0))) (?G'3986 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None (fst (extraCaps ! 0)) ntfn_cap (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) [SKIP] (doE (ntfnPtr, rights) <- case fst (extraCaps ! 0) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfn_Ptr ret__unsigned);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfn_Ptr ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,ntfn_Ptr ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 2. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 3. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> ?Q3808 current_extra_caps cap ret__unsigned rv a b) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 4. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> ?G'3986 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 5. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap rva. ?Q3822 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?Q3808 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (5 subgoals):
 1. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsignedb ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))) ntfn_cap; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; rva = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))); cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap); fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3822 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))) (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))))) (?G'3986 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))) ntfn_cap (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) [SKIP] (if \<not> to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)) then throwError Fault_H.syscall_error.IllegalOperation >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB else do notification <- getNotification (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap));
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfn_Ptr ret__unsigned);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfn_Ptr ret__unsigned);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,ntfn_Ptr ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 2. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 3. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> ?Q3808 current_extra_caps cap ret__unsigned rv a b) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 4. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> ?G'3986 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 5. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap rva. ?Q3822 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?Q3808 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (5 subgoals):
 1. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))) ntfn_cap; ret__unsignedb = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; rva = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))); cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; ret__unsignedc = capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap); fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3822 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))) (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))))) (?G'4399 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))) ntfn_cap (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) ret__unsigned) [SKIP] (if \<not> to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)) then throwError Fault_H.syscall_error.IllegalOperation >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB else do notification <- getNotification (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap));
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfn_Ptr ret__unsignedc);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfn_Ptr ret__unsignedc);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,ntfn_Ptr ret__unsignedc);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 2. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 3. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> ?Q3808 current_extra_caps cap ret__unsigned rv a b) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 4. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>vb v'. vb = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> ?G'4399 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v va vb}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 5. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap rva. ?Q3822 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?Q3808 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (5 subgoals):
 1. \<And>cap ntfn_cap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3822 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))) (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))))) (?G'4399 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))) ntfn_cap (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))) [SKIP] (if \<not> to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)) then throwError Fault_H.syscall_error.IllegalOperation >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB else do notification <- getNotification (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap));
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF \<not> to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)) THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
(\<acute>ret__int :== (if to_bool \<acute>ret__unsigned then 1 else 0);;
(IF to_bool \<acute>ret__int THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
\<acute>ret__int :== (if to_bool \<acute>ret__unsigned then 1 else 0)
FI;;
(IF to_bool \<acute>ret__int THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 2. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 3. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> ?Q3808 current_extra_caps cap ret__unsigned rv a b) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 4. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>vb v'. vb = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> ?G'4399 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v va vb}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 5. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap rva. ?Q3822 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?Q3808 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (6 subgoals):
 1. \<And>cap ntfn_cap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))); \<not> to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4583 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))) (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))))) (?S4587 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))) ntfn_cap (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))) [SKIP] (if \<not> to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)) then throwError Fault_H.syscall_error.IllegalOperation >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB else do notification <- getNotification (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap));
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
(\<acute>ret__int :== (if to_bool \<acute>ret__unsigned then 1 else 0);;
(IF to_bool \<acute>ret__int THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
\<acute>ret__int :== (if to_bool \<acute>ret__unsigned then 1 else 0)
FI;;
(IF to_bool \<acute>ret__int THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 2. \<And>cap ntfn_cap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))); \<not> \<not> to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4582 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))) (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))))) (?T4586 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))) ntfn_cap (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))) [SKIP] (if \<not> to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)) then throwError Fault_H.syscall_error.IllegalOperation >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB else do notification <- getNotification (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap));
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (SKIP;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
(\<acute>ret__int :== (if to_bool \<acute>ret__unsigned then 1 else 0);;
(IF to_bool \<acute>ret__int THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
\<acute>ret__int :== (if to_bool \<acute>ret__unsigned then 1 else 0)
FI;;
(IF to_bool \<acute>ret__int THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 3. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 4. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> ?Q4585 current_extra_caps cap ret__unsigned rv a b) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> ?R4584 current_extra_caps cap ret__unsigned rv a b)) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 5. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>vb v'. vb = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. (\<not> to_bool vb \<longrightarrow> sa \<in> ?S4587 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v va vb) \<and> (\<not> \<not> to_bool vb \<longrightarrow> sa \<in> ?T4586 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v va vb)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 6. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?Q4585 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?Q4583 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R4584 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4582 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (6 subgoals):
 1. \<And>cap ntfn_cap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) False) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) False; \<not> to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4583 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) False) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) False (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) False)) (?S4587 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) False) ntfn_cap (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))) [SKIP] (throwError (Inl Fault_H.syscall_error.IllegalOperation)) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
(\<acute>ret__int :== (if to_bool \<acute>ret__unsigned then 1 else 0);;
(IF to_bool \<acute>ret__int THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
\<acute>ret__int :== (if to_bool \<acute>ret__unsigned then 1 else 0)
FI;;
(IF to_bool \<acute>ret__int THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 2. \<And>cap ntfn_cap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))); \<not> \<not> to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4582 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))) (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))))) (?T4586 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))) ntfn_cap (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))) [SKIP] (if \<not> to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)) then throwError Fault_H.syscall_error.IllegalOperation >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB else do notification <- getNotification (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap));
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (SKIP;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
(\<acute>ret__int :== (if to_bool \<acute>ret__unsigned then 1 else 0);;
(IF to_bool \<acute>ret__int THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
\<acute>ret__int :== (if to_bool \<acute>ret__unsigned then 1 else 0)
FI;;
(IF to_bool \<acute>ret__int THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 3. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 4. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> ?Q4585 current_extra_caps cap ret__unsigned rv a b) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> ?R4584 current_extra_caps cap ret__unsigned rv a b)) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 5. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>vb v'. vb = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. (\<not> to_bool vb \<longrightarrow> sa \<in> ?S4587 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v va vb) \<and> (\<not> \<not> to_bool vb \<longrightarrow> sa \<in> ?T4586 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v va vb)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 6. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?Q4585 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?Q4583 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R4584 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4582 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (7 subgoals):
 1. \<And>cap ntfn_cap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) False) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) False; \<not> to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4597 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) False) ntfn_cap (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 2. \<And>cap ntfn_cap \<sigma>. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) False) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) False; \<not> to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (throwError (Inl Fault_H.syscall_error.IllegalOperation) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 3. \<And>cap ntfn_cap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))); \<not> \<not> to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4582 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))) (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))))) (?T4586 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))) ntfn_cap (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))) [SKIP] (if \<not> to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)) then throwError Fault_H.syscall_error.IllegalOperation >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB else do notification <- getNotification (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap));
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (SKIP;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
(\<acute>ret__int :== (if to_bool \<acute>ret__unsigned then 1 else 0);;
(IF to_bool \<acute>ret__int THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
\<acute>ret__int :== (if to_bool \<acute>ret__unsigned then 1 else 0)
FI;;
(IF to_bool \<acute>ret__int THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 4. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 5. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> ?R4584 current_extra_caps cap ret__unsigned rv a b)) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 6. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>vb v'. vb = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. (\<not> to_bool vb \<longrightarrow> sa \<in> UNIV \<inter> ?R'4597 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v va vb) \<and> (\<not> \<not> to_bool vb \<longrightarrow> sa \<in> ?T4586 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v va vb)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 7. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R4584 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4582 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (6 subgoals):
 1. \<And>cap ntfn_cap \<sigma>. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) False) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) False; \<not> to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (throwError (Inl Fault_H.syscall_error.IllegalOperation) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>cap ntfn_cap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))); \<not> \<not> to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4582 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))) (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))))) (?T4586 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))) ntfn_cap (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))) [SKIP] (if \<not> to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)) then throwError Fault_H.syscall_error.IllegalOperation >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB else do notification <- getNotification (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap));
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (SKIP;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
(\<acute>ret__int :== (if to_bool \<acute>ret__unsigned then 1 else 0);;
(IF to_bool \<acute>ret__int THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
\<acute>ret__int :== (if to_bool \<acute>ret__unsigned then 1 else 0)
FI;;
(IF to_bool \<acute>ret__int THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 3. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 4. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> ?R4584 current_extra_caps cap ret__unsigned rv a b)) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 5. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>vb v'. vb = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. (\<not> to_bool vb \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool vb \<longrightarrow> sa \<in> ?T4586 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v va vb)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 6. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R4584 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4582 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (6 subgoals):
 1. \<And>cap ntfn_cap \<sigma>. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) False) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) False; \<not> to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (throwError (Inl Fault_H.syscall_error.IllegalOperation) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))}
 2. \<And>cap ntfn_cap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))); \<not> \<not> to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4582 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))) (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))))) (?T4586 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))) ntfn_cap (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))) [SKIP] (if \<not> to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)) then throwError Fault_H.syscall_error.IllegalOperation >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB else do notification <- getNotification (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap));
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (SKIP;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
(\<acute>ret__int :== (if to_bool \<acute>ret__unsigned then 1 else 0);;
(IF to_bool \<acute>ret__int THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
\<acute>ret__int :== (if to_bool \<acute>ret__unsigned then 1 else 0)
FI;;
(IF to_bool \<acute>ret__int THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 3. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 4. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> ?R4584 current_extra_caps cap ret__unsigned rv a b)) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 5. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>vb v'. vb = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. (\<not> to_bool vb \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool vb \<longrightarrow> sa \<in> ?T4586 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v va vb)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 6. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R4584 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4582 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (5 subgoals):
 1. \<And>cap ntfn_cap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))); \<not> \<not> to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4582 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))) (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))))) (?T4586 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)))) ntfn_cap (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))) [SKIP] (if \<not> to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)) then throwError Fault_H.syscall_error.IllegalOperation >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB else do notification <- getNotification (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap));
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (SKIP;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
(\<acute>ret__int :== (if to_bool \<acute>ret__unsigned then 1 else 0);;
(IF to_bool \<acute>ret__int THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
\<acute>ret__int :== (if to_bool \<acute>ret__unsigned then 1 else 0)
FI;;
(IF to_bool \<acute>ret__int THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 2. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 3. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> ?R4584 current_extra_caps cap ret__unsigned rv a b)) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 4. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>vb v'. vb = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. (\<not> to_bool vb \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool vb \<longrightarrow> sa \<in> ?T4586 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v va vb)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 5. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R4584 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4582 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (5 subgoals):
 1. \<And>cap ntfn_cap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4582 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True)) (?T4586 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap))) [SKIP] (do notification <- getNotification (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap));
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 2. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 3. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> ?R4584 current_extra_caps cap ret__unsigned rv a b)) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 4. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>vb v'. vb = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. (\<not> to_bool vb \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool vb \<longrightarrow> sa \<in> ?T4586 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v va vb)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 5. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R4584 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4582 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (5 subgoals):
 1. \<And>cap ntfn_cap notification. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?P4621 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) a notification) (?P'4623 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)) notification) [SKIP] (doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 2. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 3. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ?P4622 current_extra_caps cap ret__unsigned rv a b ntfn))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 4. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>vb v'. vb = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. (\<not> to_bool vb \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool vb \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn va sa \<longrightarrow> s' \<in> ?P'4623 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v va vb ntfn})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 5. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?P4622 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?P4621 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (5 subgoals):
 1. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?P4621 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) a ntfn) (?P'4623 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)) ntfn) [SKIP] (doE y <- case ntfnObj ntfn of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 2. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 3. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ?P4622 current_extra_caps cap ret__unsigned rv a b ntfn))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 4. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>vb v'. vb = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. (\<not> to_bool vb \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool vb \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn va sa \<longrightarrow> s' \<in> ?P'4623 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v va vb ntfn})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 5. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?P4622 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?P4621 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (5 subgoals):
 1. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?P4629 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) a ntfn) (?P'4623 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)) ntfn) [SKIP] (doE y <- case ntfnObj ntfn of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))
 2. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 3. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ?P4622 current_extra_caps cap ret__unsigned rv a b ntfn))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 4. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>vb v'. vb = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. (\<not> to_bool vb \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool vb \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn va sa \<longrightarrow> s' \<in> ?P'4623 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v va vb ntfn})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 5. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap rva. ?P4629 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?P4622 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (5 subgoals):
 1. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?P4633 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) a ntfn) (?P'4623 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap)) ntfn) [SKIP] (doE y <- case ntfnObj ntfn of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 3. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ?P4622 current_extra_caps cap ret__unsigned rv a b ntfn))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 4. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>vb v'. vb = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. (\<not> to_bool vb \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool vb \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn va sa \<longrightarrow> s' \<in> ?P'4623 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v va vb ntfn})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 5. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap rva. ?P4633 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?P4622 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (8 subgoals):
 1. \<And>cap ntfn_cap ntfn s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. (ko_at' ntfn (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) and valid_ntfn' ntfn) s \<and> (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__int = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))\<rbrace>)
 2. \<And>cap ntfn_cap ntfn rv' t t'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))) (?y'4634 cap ntfn_cap ntfn rv')
 3. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P4638 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn) (?Q4634 cap ntfn_cap ntfn) [SKIP] (doE y <- case ntfnObj ntfn of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (?y'4634 cap ntfn_cap ntfn (from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))))
 4. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. ?Q4634 cap ntfn_cap ntfn)
 5. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 6. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (?P4639 current_extra_caps cap ret__unsigned rv a ntfn and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 7. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 8. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap rva. ?P4638 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?P4639 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (8 subgoals):
 1. \<And>cap ntfn_cap ntfn s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> UNIV \<inter> {s'. (ko_at' ntfn (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) and valid_ntfn' ntfn) s \<and> (s, s') \<in> rf_sr} \<subseteq> {sa. sa \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) \<and> (\<forall>t. ret__unsigned_' t = ntfnQueue_head_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))))) \<longrightarrow> ((if ntfnQueue_head_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))))) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := ntfnQueue_head_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))))), ret__int_' := if ntfnQueue_head_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))))) \<noteq> 0 then 1 else 0\<rparr>) \<in> rf_sr \<and> (if ntfnQueue_head_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))))) \<noteq> 0 then 1 else 0) = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) \<and> ((if ntfnQueue_head_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))))) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> sa \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) \<and> (\<forall>t. ret__unsigned_' t = ntfnBoundTCB_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))))) \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := ntfnBoundTCB_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))))), ret__int_' := if ntfnBoundTCB_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))))) \<noteq> 0 then 1 else 0\<rparr>) \<in> rf_sr \<and> (if ntfnBoundTCB_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))))) \<noteq> 0 then 1 else 0) = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn)))))}
 2. \<And>cap ntfn_cap ntfn rv' t t'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))) (?y'4634 cap ntfn_cap ntfn rv')
 3. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P4638 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn) (?Q4634 cap ntfn_cap ntfn) [SKIP] (doE y <- case ntfnObj ntfn of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (?y'4634 cap ntfn_cap ntfn (from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))))
 4. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. ?Q4634 cap ntfn_cap ntfn)
 5. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 6. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (?P4639 current_extra_caps cap ret__unsigned rv a ntfn and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 7. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 8. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?P4639 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?P4638 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (8 subgoals):
 1. \<And>cap ntfn_cap ntfn s x. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ko_at' ntfn (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) s; valid_ntfn' ntfn s; (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) \<and> ((\<exists>t. ret__unsigned_' t = ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))))))) \<longrightarrow> (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))))) \<noteq> 0 \<longrightarrow> (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn)) \<and> (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))))) = 0 \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) \<and> ((\<exists>t. ret__unsigned_' t = ntfnBoundTCB_CL (notification_lift (the (cslift x (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))))))) \<longrightarrow> (if ntfnBoundTCB_CL (notification_lift (the (cslift x (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))))) \<noteq> 0 then 1 else 0) = from_bool ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn)))))
 2. \<And>cap ntfn_cap ntfn rv' t t'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))) (?y'4634 cap ntfn_cap ntfn rv')
 3. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P4638 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn) (?Q4634 cap ntfn_cap ntfn) [SKIP] (doE y <- case ntfnObj ntfn of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (?y'4634 cap ntfn_cap ntfn (from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))))
 4. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. ?Q4634 cap ntfn_cap ntfn)
 5. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 6. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (?P4639 current_extra_caps cap ret__unsigned rv a ntfn and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 7. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 8. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?P4639 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?P4638 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (8 subgoals):
 1. \<And>cap ntfn_cap ntfn s x y'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ko_at' ntfn (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) s; valid_ntfn' ntfn s; map_to_ntfns (ksPSpace s) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) = Some ntfn; cnotification_relation (cslift x) ntfn y'; cslift x (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) = Some y'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) \<and> ((\<exists>t. ret__unsigned_' t = ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))))))) \<longrightarrow> (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))))) \<noteq> 0 \<longrightarrow> (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn)) \<and> (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))))) = 0 \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) \<and> ((\<exists>t. ret__unsigned_' t = ntfnBoundTCB_CL (notification_lift (the (cslift x (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))))))) \<longrightarrow> (if ntfnBoundTCB_CL (notification_lift (the (cslift x (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))))) \<noteq> 0 then 1 else 0) = from_bool ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn)))))
 2. \<And>cap ntfn_cap ntfn rv' t t'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))) (?y'4634 cap ntfn_cap ntfn rv')
 3. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P4638 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn) (?Q4634 cap ntfn_cap ntfn) [SKIP] (doE y <- case ntfnObj ntfn of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (?y'4634 cap ntfn_cap ntfn (from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))))
 4. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. ?Q4634 cap ntfn_cap ntfn)
 5. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 6. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (?P4639 current_extra_caps cap ret__unsigned rv a ntfn and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 7. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 8. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?P4639 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?P4638 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (8 subgoals):
 1. \<And>cap ntfn_cap ntfn s x y' t. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ko_at' ntfn (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) s; map_to_ntfns (ksPSpace s) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) = Some ntfn; cslift x (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) = Some y'; case ntfnObj ntfn of Structures_H.ntfn.WaitingNtfn ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts \<and> (case ntfnBoundTCB ntfn of None \<Rightarrow> True | Some tcb \<Rightarrow> ts = [tcb]) | _ \<Rightarrow> True; valid_bound_tcb' (ntfnBoundTCB ntfn) s; case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> notification_CL.state_CL (notification_lift y') = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle \<and> ep_queue_relation' (cslift x) [] (tcb_Ptr (ntfnQueue_head_CL (notification_lift y'))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift y'))) | Structures_H.ntfn.ActiveNtfn msgid \<Rightarrow> notification_CL.state_CL (notification_lift y') = SCAST(32 signed \<rightarrow> 32) NtfnState_Active \<and> msgid = ntfnMsgIdentifier_CL (notification_lift y') \<and> ep_queue_relation' (cslift x) [] (tcb_Ptr (ntfnQueue_head_CL (notification_lift y'))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift y'))) | Structures_H.ntfn.WaitingNtfn q \<Rightarrow> notification_CL.state_CL (notification_lift y') = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<and> ep_queue_relation' (cslift x) q (tcb_Ptr (ntfnQueue_head_CL (notification_lift y'))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift y'))); option_to_ctcb_ptr (ntfnBoundTCB ntfn) = tcb_Ptr (ntfnBoundTCB_CL (notification_lift y')); ret__unsigned_' t = ntfnQueue_head_CL (notification_lift y')\<rbrakk> \<Longrightarrow> (ntfnQueue_head_CL (notification_lift y') \<noteq> 0 \<longrightarrow> (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn)) \<and> (ntfnQueue_head_CL (notification_lift y') = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = ntfnBoundTCB_CL (notification_lift y')) \<longrightarrow> (if ntfnBoundTCB_CL (notification_lift y') \<noteq> 0 then 1 else 0) = from_bool ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn)))
 2. \<And>cap ntfn_cap ntfn rv' t t'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))) (?y'4634 cap ntfn_cap ntfn rv')
 3. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P4638 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn) (?Q4634 cap ntfn_cap ntfn) [SKIP] (doE y <- case ntfnObj ntfn of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (?y'4634 cap ntfn_cap ntfn (from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))))
 4. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. ?Q4634 cap ntfn_cap ntfn)
 5. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 6. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (?P4639 current_extra_caps cap ret__unsigned rv a ntfn and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 7. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 8. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?P4639 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?P4638 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (7 subgoals):
 1. \<And>cap ntfn_cap ntfn rv' t t'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))) (?y'4634 cap ntfn_cap ntfn rv')
 2. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P4638 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn) (?Q4634 cap ntfn_cap ntfn) [SKIP] (doE y <- case ntfnObj ntfn of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (?y'4634 cap ntfn_cap ntfn (from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))))
 3. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. ?Q4634 cap ntfn_cap ntfn)
 4. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 5. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (?P4639 current_extra_caps cap ret__unsigned rv a ntfn and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 6. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 7. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?P4639 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?P4638 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (6 subgoals):
 1. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P4638 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn) (?Q4634 cap ntfn_cap ntfn) [SKIP] (doE y <- case ntfnObj ntfn of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn)) \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. ?Q4634 cap ntfn_cap ntfn)
 3. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 4. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (?P4639 current_extra_caps cap ret__unsigned rv a ntfn and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 5. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 6. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?P4639 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?P4638 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (6 subgoals):
 1. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P'4920 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn) (?Q4916 cap ntfn_cap ntfn) [SKIP] (doE y <- case ntfnObj ntfn of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn)) \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> ?Q4916 cap ntfn_cap ntfn})
 3. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 4. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and ?P'4921 current_extra_caps cap ret__unsigned rv a ntfn and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 5. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 6. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap rva. ?P'4920 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?P'4921 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (6 subgoals):
 1. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P'4920 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn) (?Q4916 cap ntfn_cap ntfn) [SKIP] ((case ntfnObj ntfn of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= case_sum (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) (\<lambda>rv. returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB)) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> ?Q4916 cap ntfn_cap ntfn})
 3. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 4. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and ?P'4921 current_extra_caps cap ret__unsigned rv a ntfn and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 5. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 6. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap rva. ?P'4920 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?P'4921 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (8 subgoals):
 1. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4943 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn) (?R''4936 cap ntfn_cap ntfn) [SKIP] (do a <- case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4955 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x2) (?R''4935 cap ntfn_cap ntfn x2) [SKIP] (do a <- case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 3. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 4. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> ?R''4936 cap ntfn_cap ntfn} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''4935 cap ntfn_cap ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 5. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 6. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ?R4946 current_extra_caps cap ret__unsigned rv a ntfn b) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R4945 current_extra_caps cap ret__unsigned rv a ntfn b x) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 7. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 8. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R4946 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4943 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap rva. ?R4955 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R4945 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (8 subgoals):
 1. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4943 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn) (?R''4936 cap ntfn_cap ntfn) [SKIP] (do a <- if ntfnBoundTCB ntfn = None then returnOk () else throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4955 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x2) (?R''4935 cap ntfn_cap ntfn x2) [SKIP] (do a <- case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 3. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 4. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> ?R''4936 cap ntfn_cap ntfn} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''4935 cap ntfn_cap ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 5. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 6. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ?R4946 current_extra_caps cap ret__unsigned rv a ntfn b) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R4945 current_extra_caps cap ret__unsigned rv a ntfn b x) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 7. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 8. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R4946 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4943 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap rva. ?R4955 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R4945 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (9 subgoals):
 1. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4958 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn) (?S4956 cap ntfn_cap ntfn) [SKIP] (do a <- if ntfnBoundTCB ntfn = None then returnOk () else throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; \<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4957 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn) (?T4956 cap ntfn_cap ntfn) [SKIP] (do a <- if ntfnBoundTCB ntfn = None then returnOk () else throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 3. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4955 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x2) (?R''4935 cap ntfn_cap ntfn x2) [SKIP] (do a <- case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 4. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 5. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> ?S4956 cap ntfn_cap ntfn) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> ?T4956 cap ntfn_cap ntfn)}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''4935 cap ntfn_cap ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 6. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 7. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> ?Q4960 current_extra_caps cap ret__unsigned rv a ntfn b) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ?R4959 current_extra_caps cap ret__unsigned rv a ntfn b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R4945 current_extra_caps cap ret__unsigned rv a ntfn b x) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 8. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 9. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?Q4960 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?Q4958 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R4959 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4957 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap rva. ?R4955 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R4945 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (9 subgoals):
 1. \<And>cap ntfn_cap ntfn y. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some y\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4958 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn) (?S4956 cap ntfn_cap ntfn) [SKIP] (do a <- throwError Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; \<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4957 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn) (?T4956 cap ntfn_cap ntfn) [SKIP] (do a <- if ntfnBoundTCB ntfn = None then returnOk () else throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 3. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4955 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x2) (?R''4935 cap ntfn_cap ntfn x2) [SKIP] (do a <- case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 4. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 5. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> ?S4956 cap ntfn_cap ntfn) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> ?T4956 cap ntfn_cap ntfn)}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''4935 cap ntfn_cap ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 6. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 7. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> ?Q4960 current_extra_caps cap ret__unsigned rv a ntfn b) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ?R4959 current_extra_caps cap ret__unsigned rv a ntfn b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R4945 current_extra_caps cap ret__unsigned rv a ntfn b x) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 8. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 9. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?Q4960 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?Q4958 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R4959 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4957 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap rva. ?R4955 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R4945 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (9 subgoals):
 1. \<And>cap ntfn_cap ntfn y. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some y\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4958 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn) (?S4956 cap ntfn_cap ntfn) [SKIP] (throwError (Inl Fault_H.syscall_error.IllegalOperation)) (\<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; \<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4957 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn) (?T4956 cap ntfn_cap ntfn) [SKIP] (do a <- if ntfnBoundTCB ntfn = None then returnOk () else throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 3. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4955 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x2) (?R''4935 cap ntfn_cap ntfn x2) [SKIP] (do a <- case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 4. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 5. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> ?S4956 cap ntfn_cap ntfn) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> ?T4956 cap ntfn_cap ntfn)}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''4935 cap ntfn_cap ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 6. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 7. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> ?Q4960 current_extra_caps cap ret__unsigned rv a ntfn b) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ?R4959 current_extra_caps cap ret__unsigned rv a ntfn b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R4945 current_extra_caps cap ret__unsigned rv a ntfn b x) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 8. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 9. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?Q4960 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?Q4958 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R4959 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4957 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap rva. ?R4955 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R4945 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (10 subgoals):
 1. \<And>cap ntfn_cap ntfn y. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4968 cap ntfn_cap ntfn) \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 2. \<And>cap ntfn_cap ntfn y \<sigma>. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (throwError (Inl Fault_H.syscall_error.IllegalOperation) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 3. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; \<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4957 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn) (?T4956 cap ntfn_cap ntfn) [SKIP] (do a <- if ntfnBoundTCB ntfn = None then returnOk () else throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 4. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4955 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x2) (?R''4935 cap ntfn_cap ntfn x2) [SKIP] (do a <- case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 5. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 6. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> ?R'4968 cap ntfn_cap ntfn) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> ?T4956 cap ntfn_cap ntfn)}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''4935 cap ntfn_cap ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 7. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 8. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ?R4959 current_extra_caps cap ret__unsigned rv a ntfn b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R4945 current_extra_caps cap ret__unsigned rv a ntfn b x) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 9. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 10. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R4959 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4957 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap rva. ?R4955 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R4945 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (9 subgoals):
 1. \<And>cap ntfn_cap ntfn y \<sigma>. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (throwError (Inl Fault_H.syscall_error.IllegalOperation) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; \<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4957 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn) (?T4956 cap ntfn_cap ntfn) [SKIP] (do a <- if ntfnBoundTCB ntfn = None then returnOk () else throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 3. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4955 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x2) (?R''4935 cap ntfn_cap ntfn x2) [SKIP] (do a <- case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 4. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 5. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> ?T4956 cap ntfn_cap ntfn)}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''4935 cap ntfn_cap ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 6. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 7. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ?R4959 current_extra_caps cap ret__unsigned rv a ntfn b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R4945 current_extra_caps cap ret__unsigned rv a ntfn b x) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 8. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 9. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R4959 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4957 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap rva. ?R4955 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R4945 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (9 subgoals):
 1. \<And>cap ntfn_cap ntfn y \<sigma>. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = Some y\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (throwError (Inl Fault_H.syscall_error.IllegalOperation) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))}
 2. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; \<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4957 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn) (?T4956 cap ntfn_cap ntfn) [SKIP] (do a <- if ntfnBoundTCB ntfn = None then returnOk () else throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 3. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4955 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x2) (?R''4935 cap ntfn_cap ntfn x2) [SKIP] (do a <- case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 4. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 5. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> ?T4956 cap ntfn_cap ntfn)}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''4935 cap ntfn_cap ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 6. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 7. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ?R4959 current_extra_caps cap ret__unsigned rv a ntfn b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R4945 current_extra_caps cap ret__unsigned rv a ntfn b x) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 8. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 9. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R4959 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4957 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap rva. ?R4955 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R4945 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (8 subgoals):
 1. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; \<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4957 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn) (?T4956 cap ntfn_cap ntfn) [SKIP] (do a <- if ntfnBoundTCB ntfn = None then returnOk () else throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4955 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x2) (?R''4935 cap ntfn_cap ntfn x2) [SKIP] (do a <- case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 3. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 4. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> ?T4956 cap ntfn_cap ntfn)}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''4935 cap ntfn_cap ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 5. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 6. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ?R4959 current_extra_caps cap ret__unsigned rv a ntfn b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R4945 current_extra_caps cap ret__unsigned rv a ntfn b x) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 7. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 8. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R4959 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4957 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap rva. ?R4955 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R4945 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (8 subgoals):
 1. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4957 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn) (?T4956 cap ntfn_cap ntfn) [SKIP] (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))))) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))
 2. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4955 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x2) (?R''4935 cap ntfn_cap ntfn x2) [SKIP] (do a <- case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 3. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 4. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> ?T4956 cap ntfn_cap ntfn)}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''4935 cap ntfn_cap ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 5. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 6. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ?R4959 current_extra_caps cap ret__unsigned rv a ntfn b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R4945 current_extra_caps cap ret__unsigned rv a ntfn b x) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 7. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 8. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R4959 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4957 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap rva. ?R4955 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R4945 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (8 subgoals):
 1. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4957 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn) (?T4956 cap ntfn_cap ntfn) [SKIP] (do _ <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- invokeTCB (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE
od) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))
 2. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4955 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x2) (?R''4935 cap ntfn_cap ntfn x2) [SKIP] (do a <- case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 3. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 4. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> ?T4956 cap ntfn_cap ntfn)}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''4935 cap ntfn_cap ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 5. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 6. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ?R4959 current_extra_caps cap ret__unsigned rv a ntfn b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R4945 current_extra_caps cap ret__unsigned rv a ntfn b x) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 7. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 8. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R4959 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4957 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap rva. ?R4955 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R4945 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (10 subgoals):
 1. \<And>cap ntfn_cap ntfn rv xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4996 cap ntfn_cap ntfn rv) (?Q'4996 cap ntfn_cap ntfn rv xfdc) [SKIP] (doE reply <- invokeTCB (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<lbrace>?R5001 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q4996 cap ntfn_cap ntfn\<rbrace>
 3. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4996 cap ntfn_cap ntfn) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'4996 cap ntfn_cap ntfn rv (xfdc s)}
 4. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4955 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x2) (?R''4935 cap ntfn_cap ntfn x2) [SKIP] (do a <- case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 5. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 6. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4996 cap ntfn_cap ntfn)}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''4935 cap ntfn_cap ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 7. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 8. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?R5003 current_extra_caps cap ret__unsigned rv a ntfn) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R4945 current_extra_caps cap ret__unsigned rv a ntfn b x) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 9. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 10. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R5003 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R5001 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap rva. ?R4955 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R4945 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (13 subgoals):
 1. \<And>cap ntfn_cap ntfn rv xfdc rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None; dc rv xfdc; rva = []; id ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5046 cap ntfn_cap ntfn rv xfdc rva) (?Q'5046 cap ntfn_cap ntfn rv xfdc rva ret__unsigned_long) [SKIP] (if rva = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread rva isCall)) (return_C ret__unsigned_long_'_update (\<lambda>a. ret__unsigned_long))
 2. \<And>cap ntfn_cap ntfn rv xfdc err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None; dc rv xfdc; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5046 cap ntfn_cap ntfn rv xfdc err) (?Q''5046 cap ntfn_cap ntfn rv xfdc err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 3. \<And>cap ntfn_cap ntfn rv xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5050 cap ntfn_cap ntfn rv\<rbrace> invokeTCB (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) \<lbrace>?Q5046 cap ntfn_cap ntfn rv xfdc\<rbrace>, \<lbrace>?QE5046 cap ntfn_cap ntfn rv xfdc\<rbrace>
 4. \<And>cap ntfn_cap ntfn rv xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None; dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5046 cap ntfn_cap ntfn rv xfdc) \<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. rva = [] \<longrightarrow> s \<in> ?Q'5046 cap ntfn_cap ntfn rv xfdc rva (ret__unsigned_long_' s))) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5046 cap ntfn_cap ntfn rv xfdc err (ret__unsigned_long_' s) (errstate s)))}
 5. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<lbrace>?R5001 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and tcb_inv_wf' (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) and ?R5050 cap ntfn_cap ntfn a\<rbrace>
 6. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4996 cap ntfn_cap ntfn) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) (tcb_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))\<rbrace>} \<inter> ?R'5046 cap ntfn_cap ntfn rv (xfdc s)}
 7. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4955 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x2) (?R''4935 cap ntfn_cap ntfn x2) [SKIP] (do a <- case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 8. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 9. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4996 cap ntfn_cap ntfn)}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''4935 cap ntfn_cap ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 10. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>cap. ?R5003 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R5001 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap rva. ?R4955 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R4945 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (13 subgoals):
 1. \<And>cap ntfn_cap ntfn xfdc rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None; rva = []; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5046 cap ntfn_cap ntfn () xfdc []) (?Q'5046 cap ntfn_cap ntfn () xfdc [] (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>cap ntfn_cap ntfn rv xfdc err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None; dc rv xfdc; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5046 cap ntfn_cap ntfn rv xfdc err) (?Q''5046 cap ntfn_cap ntfn rv xfdc err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 3. \<And>cap ntfn_cap ntfn rv xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5050 cap ntfn_cap ntfn rv\<rbrace> invokeTCB (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) \<lbrace>?Q5046 cap ntfn_cap ntfn rv xfdc\<rbrace>, \<lbrace>?QE5046 cap ntfn_cap ntfn rv xfdc\<rbrace>
 4. \<And>cap ntfn_cap ntfn rv xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None; dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5046 cap ntfn_cap ntfn rv xfdc) \<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. rva = [] \<longrightarrow> s \<in> ?Q'5046 cap ntfn_cap ntfn rv xfdc rva (ret__unsigned_long_' s))) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5046 cap ntfn_cap ntfn rv xfdc err (ret__unsigned_long_' s) (errstate s)))}
 5. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<lbrace>?R5001 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and tcb_inv_wf' (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) and ?R5050 cap ntfn_cap ntfn a\<rbrace>
 6. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4996 cap ntfn_cap ntfn) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) (tcb_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))\<rbrace>} \<inter> ?R'5046 cap ntfn_cap ntfn rv (xfdc s)}
 7. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4955 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x2) (?R''4935 cap ntfn_cap ntfn x2) [SKIP] (do a <- case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 8. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 9. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4996 cap ntfn_cap ntfn)}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''4935 cap ntfn_cap ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 10. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>cap. ?R5003 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R5001 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap rva. ?R4955 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R4945 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (13 subgoals):
 1. \<And>cap ntfn_cap ntfn xfdc rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None; rva = []; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5046 cap ntfn_cap ntfn () xfdc []) (?Q'5046 cap ntfn_cap ntfn () xfdc [] (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>cap ntfn_cap ntfn rv xfdc err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None; dc rv xfdc; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5046 cap ntfn_cap ntfn rv xfdc err) (?Q''5046 cap ntfn_cap ntfn rv xfdc err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 3. \<And>cap ntfn_cap ntfn rv xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5050 cap ntfn_cap ntfn rv\<rbrace> invokeTCB (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) \<lbrace>?Q5046 cap ntfn_cap ntfn rv xfdc\<rbrace>, \<lbrace>?QE5046 cap ntfn_cap ntfn rv xfdc\<rbrace>
 4. \<And>cap ntfn_cap ntfn rv xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None; dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5046 cap ntfn_cap ntfn rv xfdc) \<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. rva = [] \<longrightarrow> s \<in> ?Q'5046 cap ntfn_cap ntfn rv xfdc rva (ret__unsigned_long_' s))) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5046 cap ntfn_cap ntfn rv xfdc err (ret__unsigned_long_' s) (errstate s)))}
 5. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<lbrace>?R5001 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and tcb_inv_wf' (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) and ?R5050 cap ntfn_cap ntfn a\<rbrace>
 6. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4996 cap ntfn_cap ntfn) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) (tcb_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))\<rbrace>} \<inter> ?R'5046 cap ntfn_cap ntfn rv (xfdc s)}
 7. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4955 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x2) (?R''4935 cap ntfn_cap ntfn x2) [SKIP] (do a <- case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 8. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 9. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4996 cap ntfn_cap ntfn)}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''4935 cap ntfn_cap ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 10. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>cap. ?R5003 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R5001 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap rva. ?R4955 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R4945 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (12 subgoals):
 1. \<And>cap ntfn_cap ntfn rv xfdc err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None; dc rv xfdc; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5046 cap ntfn_cap ntfn rv xfdc err) (?Q''5046 cap ntfn_cap ntfn rv xfdc err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 2. \<And>cap ntfn_cap ntfn rv xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5050 cap ntfn_cap ntfn rv\<rbrace> invokeTCB (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE5046 cap ntfn_cap ntfn rv xfdc\<rbrace>
 3. \<And>cap ntfn_cap ntfn rv xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None; dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5046 cap ntfn_cap ntfn rv xfdc) \<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. rva = [] \<longrightarrow> s \<in> \<lbrace>id \<^bsup>s\<^esup>ret__unsigned_long = \<^bsup>s\<^esup>ret__unsigned_long \<and> dc rv (K rv \<^bsup>s\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5046 cap ntfn_cap ntfn rv xfdc err (ret__unsigned_long_' s) (errstate s)))}
 4. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<lbrace>?R5001 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and tcb_inv_wf' (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) and ?R5050 cap ntfn_cap ntfn a\<rbrace>
 5. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4996 cap ntfn_cap ntfn) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) (tcb_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))\<rbrace>} \<inter> ?R'5046 cap ntfn_cap ntfn rv (xfdc s)}
 6. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4955 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x2) (?R''4935 cap ntfn_cap ntfn x2) [SKIP] (do a <- case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 7. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 8. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4996 cap ntfn_cap ntfn)}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''4935 cap ntfn_cap ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 9. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 10. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?R5003 current_extra_caps cap ret__unsigned rv a ntfn) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R4945 current_extra_caps cap ret__unsigned rv a ntfn b x) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>cap. ?R5003 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R5001 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap rva. ?R4955 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R4945 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (11 subgoals):
 1. \<And>cap ntfn_cap ntfn rv xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5050 cap ntfn_cap ntfn rv\<rbrace> invokeTCB (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>cap ntfn_cap ntfn rv xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None; dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5046 cap ntfn_cap ntfn rv xfdc) \<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. rva = [] \<longrightarrow> s \<in> \<lbrace>id \<^bsup>s\<^esup>ret__unsigned_long = \<^bsup>s\<^esup>ret__unsigned_long \<and> dc rv (K rv \<^bsup>s\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> {sa. id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' s)) (errstate sa)}))}
 3. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<lbrace>?R5001 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and tcb_inv_wf' (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) and ?R5050 cap ntfn_cap ntfn a\<rbrace>
 4. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4996 cap ntfn_cap ntfn) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) (tcb_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))\<rbrace>} \<inter> ?R'5046 cap ntfn_cap ntfn rv (xfdc s)}
 5. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4955 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x2) (?R''4935 cap ntfn_cap ntfn x2) [SKIP] (do a <- case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 6. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 7. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4996 cap ntfn_cap ntfn)}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''4935 cap ntfn_cap ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 8. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 9. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?R5003 current_extra_caps cap ret__unsigned rv a ntfn) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R4945 current_extra_caps cap ret__unsigned rv a ntfn b x) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 10. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
A total of 11 subgoals...
flex-flex pairs:
\<lambda>cap. ?R5003 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R5001 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap rva. ?R4955 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R4945 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (10 subgoals):
 1. \<And>cap ntfn_cap ntfn rv xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None; dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5046 cap ntfn_cap ntfn rv xfdc) \<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. rva = [] \<longrightarrow> s \<in> \<lbrace>id \<^bsup>s\<^esup>ret__unsigned_long = \<^bsup>s\<^esup>ret__unsigned_long \<and> dc rv (K rv \<^bsup>s\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> {sa. id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' s)) (errstate sa)}))}
 2. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<lbrace>?R5001 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and tcb_inv_wf' (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) and (\<lambda>a. True \<and> True)\<rbrace>
 3. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4996 cap ntfn_cap ntfn) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) (tcb_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))\<rbrace>} \<inter> ?R'5046 cap ntfn_cap ntfn rv (xfdc s)}
 4. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4955 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x2) (?R''4935 cap ntfn_cap ntfn x2) [SKIP] (do a <- case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 5. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 6. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4996 cap ntfn_cap ntfn)}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''4935 cap ntfn_cap ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 7. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 8. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?R5003 current_extra_caps cap ret__unsigned rv a ntfn) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R4945 current_extra_caps cap ret__unsigned rv a ntfn b x) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 9. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 10. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R5003 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R5001 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap rva. ?R4955 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R4945 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (9 subgoals):
 1. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<lbrace>?R5001 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and tcb_inv_wf' (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) and (\<lambda>a. True \<and> True)\<rbrace>
 2. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4996 cap ntfn_cap ntfn) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) (tcb_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))}}
 3. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4955 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x2) (?R''4935 cap ntfn_cap ntfn x2) [SKIP] (do a <- case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 4. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 5. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4996 cap ntfn_cap ntfn)}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''4935 cap ntfn_cap ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 6. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 7. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?R5003 current_extra_caps cap ret__unsigned rv a ntfn) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R4945 current_extra_caps cap ret__unsigned rv a ntfn b x) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 8. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 9. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R5003 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R5001 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap rva. ?R4955 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R4945 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (9 subgoals):
 1. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<lbrace>?R5001 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a b. invs' b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ko. ntfnBoundTCB ko = None \<and> (\<forall>q. ntfnObj ko \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) b \<and> ex_nonz_cap_to' (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) b \<and> bound_tcb_at' ((=) None) (capTCBPtr cp) b\<rbrace>
 2. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4996 cap ntfn_cap ntfn) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) (tcb_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))}}
 3. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4955 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x2) (?R''4935 cap ntfn_cap ntfn x2) [SKIP] (do a <- case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 4. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 5. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4996 cap ntfn_cap ntfn)}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''4935 cap ntfn_cap ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 6. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 7. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?R5003 current_extra_caps cap ret__unsigned rv a ntfn) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R4945 current_extra_caps cap ret__unsigned rv a ntfn b x) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 8. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 9. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R5003 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R5001 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap rva. ?R4955 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R4945 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (8 subgoals):
 1. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4996 cap ntfn_cap ntfn) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})
 2. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4955 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x2) (?R''4935 cap ntfn_cap ntfn x2) [SKIP] (do a <- case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 3. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 4. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4996 cap ntfn_cap ntfn)}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''4935 cap ntfn_cap ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 5. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 6. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R4945 current_extra_caps cap ret__unsigned rv a ntfn b x) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 7. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 8. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap rva. ?R4955 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R4945 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (7 subgoals):
 1. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4955 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x2) (?R''4935 cap ntfn_cap ntfn x2) [SKIP] (do a <- case ntfnBoundTCB ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 3. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''4935 cap ntfn_cap ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 4. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 5. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R4945 current_extra_caps cap ret__unsigned rv a ntfn b x) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 6. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 7. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap rva. ?R4955 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R4945 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (7 subgoals):
 1. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4955 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x2) (?R''4935 cap ntfn_cap ntfn x2) [SKIP] (do a <- if ntfnBoundTCB ntfn = None then returnOk () else throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x2) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 3. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''4935 cap ntfn_cap ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 4. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 5. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R4945 current_extra_caps cap ret__unsigned rv a ntfn b x) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 6. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 7. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap rva. ?R4955 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R4945 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (8 subgoals):
 1. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x2)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>s. ?Q5225 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn s x2) (?S5217 cap ntfn_cap ntfn x2) [SKIP] (do a <- if ntfnBoundTCB ntfn = None then returnOk () else throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; \<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x2))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>s. ?R5224 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn s x2) (?T5217 cap ntfn_cap ntfn x2) [SKIP] (do a <- if ntfnBoundTCB ntfn = None then returnOk () else throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 3. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 4. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> s \<in> ?S5217 cap ntfn_cap ntfn x) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> s \<in> ?T5217 cap ntfn_cap ntfn x)}}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 5. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 6. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> ?Q5221 current_extra_caps cap ret__unsigned rv a ntfn b x) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> ?R5220 current_extra_caps cap ret__unsigned rv a ntfn b x)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 7. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 8. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap rva. ?Q5225 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?Q5221 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap rva. ?R5224 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R5220 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (8 subgoals):
 1. \<And>cap ntfn_cap ntfn x2 y. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = Some y\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?Q5225 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x2) (?S5217 cap ntfn_cap ntfn x2) [SKIP] (do a <- throwError Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; \<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x2))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>s. ?R5224 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn s x2) (?T5217 cap ntfn_cap ntfn x2) [SKIP] (do a <- if ntfnBoundTCB ntfn = None then returnOk () else throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 3. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 4. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> s \<in> ?S5217 cap ntfn_cap ntfn x) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> s \<in> ?T5217 cap ntfn_cap ntfn x)}}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 5. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 6. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> ?Q5221 current_extra_caps cap ret__unsigned rv a ntfn b x) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> ?R5220 current_extra_caps cap ret__unsigned rv a ntfn b x)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 7. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 8. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap rva. ?Q5225 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?Q5221 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap rva. ?R5224 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R5220 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (8 subgoals):
 1. \<And>cap ntfn_cap ntfn x2 y. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = Some y\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?Q5225 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x2) (?S5217 cap ntfn_cap ntfn x2) [SKIP] (throwError (Inl Fault_H.syscall_error.IllegalOperation)) (\<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; \<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x2))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>s. ?R5224 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn s x2) (?T5217 cap ntfn_cap ntfn x2) [SKIP] (do a <- if ntfnBoundTCB ntfn = None then returnOk () else throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 3. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 4. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> s \<in> ?S5217 cap ntfn_cap ntfn x) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> s \<in> ?T5217 cap ntfn_cap ntfn x)}}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 5. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 6. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> ?Q5221 current_extra_caps cap ret__unsigned rv a ntfn b x) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> ?R5220 current_extra_caps cap ret__unsigned rv a ntfn b x)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 7. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 8. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap rva. ?Q5225 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?Q5221 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap rva. ?R5224 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R5220 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (9 subgoals):
 1. \<And>cap ntfn_cap ntfn x2 y. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5235 cap ntfn_cap ntfn x2) \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 2. \<And>cap ntfn_cap ntfn x2 y \<sigma>. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (throwError (Inl Fault_H.syscall_error.IllegalOperation) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 3. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; \<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x2))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>s. ?R5224 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn s x2) (?T5217 cap ntfn_cap ntfn x2) [SKIP] (do a <- if ntfnBoundTCB ntfn = None then returnOk () else throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 4. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 5. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> s \<in> UNIV \<inter> ?R'5235 cap ntfn_cap ntfn x) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> s \<in> ?T5217 cap ntfn_cap ntfn x)}}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 6. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 7. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> ?R5220 current_extra_caps cap ret__unsigned rv a ntfn b x)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 8. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 9. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap rva. ?R5224 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R5220 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (8 subgoals):
 1. \<And>cap ntfn_cap ntfn x2 y \<sigma>. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = Some y\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (throwError (Inl Fault_H.syscall_error.IllegalOperation) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; \<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x2))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>s. ?R5224 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn s x2) (?T5217 cap ntfn_cap ntfn x2) [SKIP] (do a <- if ntfnBoundTCB ntfn = None then returnOk () else throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 3. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 4. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> s \<in> ?T5217 cap ntfn_cap ntfn x)}}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 5. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 6. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> ?R5220 current_extra_caps cap ret__unsigned rv a ntfn b x)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 7. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 8. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap rva. ?R5224 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R5220 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (8 subgoals):
 1. \<And>cap ntfn_cap ntfn x2 y \<sigma>. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = Some y\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (throwError (Inl Fault_H.syscall_error.IllegalOperation) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))}
 2. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; \<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x2))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>s. ?R5224 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn s x2) (?T5217 cap ntfn_cap ntfn x2) [SKIP] (do a <- if ntfnBoundTCB ntfn = None then returnOk () else throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 3. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 4. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> s \<in> ?T5217 cap ntfn_cap ntfn x)}}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 5. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 6. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> ?R5220 current_extra_caps cap ret__unsigned rv a ntfn b x)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 7. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 8. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap rva. ?R5224 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R5220 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (7 subgoals):
 1. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; \<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x2))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>s. ?R5224 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn s x2) (?T5217 cap ntfn_cap ntfn x2) [SKIP] (do a <- if ntfnBoundTCB ntfn = None then returnOk () else throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 3. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> s \<in> ?T5217 cap ntfn_cap ntfn x)}}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 4. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 5. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> ?R5220 current_extra_caps cap ret__unsigned rv a ntfn b x)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 6. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 7. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap rva. ?R5224 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R5220 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (7 subgoals):
 1. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R5224 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x2) (?T5217 cap ntfn_cap ntfn x2) [SKIP] (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))))) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))
 2. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 3. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> s \<in> ?T5217 cap ntfn_cap ntfn x)}}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 4. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 5. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> ?R5220 current_extra_caps cap ret__unsigned rv a ntfn b x)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 6. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 7. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap rva. ?R5224 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R5220 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (7 subgoals):
 1. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R5224 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x2) (?T5217 cap ntfn_cap ntfn x2) [SKIP] (do _ <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- invokeTCB (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE
od) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))
 2. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 3. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> s \<in> ?T5217 cap ntfn_cap ntfn x)}}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 4. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 5. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> ?R5220 current_extra_caps cap ret__unsigned rv a ntfn b x)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 6. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 7. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap rva. ?R5224 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R5220 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (9 subgoals):
 1. \<And>cap ntfn_cap ntfn x2 rv xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5264 cap ntfn_cap ntfn x2 rv) (?Q'5264 cap ntfn_cap ntfn x2 rv xfdc) [SKIP] (doE reply <- invokeTCB (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<lbrace>?R5269 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn x2\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q5264 cap ntfn_cap ntfn x2\<rbrace>
 3. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5264 cap ntfn_cap ntfn x2) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'5264 cap ntfn_cap ntfn x2 rv (xfdc s)}
 4. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 5. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5264 cap ntfn_cap ntfn x)}}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 6. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 7. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?R5271 current_extra_caps cap ret__unsigned rv a ntfn x) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 8. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 9. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R5271 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R5269 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (12 subgoals):
 1. \<And>cap ntfn_cap ntfn x2 rv xfdc rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None; dc rv xfdc; rva = []; id ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5314 cap ntfn_cap ntfn x2 rv xfdc rva) (?Q'5314 cap ntfn_cap ntfn x2 rv xfdc rva ret__unsigned_long) [SKIP] (if rva = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread rva isCall)) (return_C ret__unsigned_long_'_update (\<lambda>a. ret__unsigned_long))
 2. \<And>cap ntfn_cap ntfn x2 rv xfdc err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None; dc rv xfdc; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5314 cap ntfn_cap ntfn x2 rv xfdc err) (?Q''5314 cap ntfn_cap ntfn x2 rv xfdc err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 3. \<And>cap ntfn_cap ntfn x2 rv xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5318 cap ntfn_cap ntfn x2 rv\<rbrace> invokeTCB (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) \<lbrace>?Q5314 cap ntfn_cap ntfn x2 rv xfdc\<rbrace>, \<lbrace>?QE5314 cap ntfn_cap ntfn x2 rv xfdc\<rbrace>
 4. \<And>cap ntfn_cap ntfn x2 rv xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None; dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5314 cap ntfn_cap ntfn x2 rv xfdc) \<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. rva = [] \<longrightarrow> s \<in> ?Q'5314 cap ntfn_cap ntfn x2 rv xfdc rva (ret__unsigned_long_' s))) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5314 cap ntfn_cap ntfn x2 rv xfdc err (ret__unsigned_long_' s) (errstate s)))}
 5. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<lbrace>?R5269 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn x2\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and tcb_inv_wf' (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) and ?R5318 cap ntfn_cap ntfn x2 a\<rbrace>
 6. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5264 cap ntfn_cap ntfn x2) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) (tcb_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))\<rbrace>} \<inter> ?R'5314 cap ntfn_cap ntfn x2 rv (xfdc s)}
 7. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 8. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5264 cap ntfn_cap ntfn x)}}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 9. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 10. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?R5271 current_extra_caps cap ret__unsigned rv a ntfn x) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>cap. ?R5271 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R5269 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (12 subgoals):
 1. \<And>cap ntfn_cap ntfn x2 xfdc rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None; rva = []; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5314 cap ntfn_cap ntfn x2 () xfdc []) (?Q'5314 cap ntfn_cap ntfn x2 () xfdc [] (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>cap ntfn_cap ntfn x2 rv xfdc err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None; dc rv xfdc; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5314 cap ntfn_cap ntfn x2 rv xfdc err) (?Q''5314 cap ntfn_cap ntfn x2 rv xfdc err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 3. \<And>cap ntfn_cap ntfn x2 rv xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5318 cap ntfn_cap ntfn x2 rv\<rbrace> invokeTCB (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) \<lbrace>?Q5314 cap ntfn_cap ntfn x2 rv xfdc\<rbrace>, \<lbrace>?QE5314 cap ntfn_cap ntfn x2 rv xfdc\<rbrace>
 4. \<And>cap ntfn_cap ntfn x2 rv xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None; dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5314 cap ntfn_cap ntfn x2 rv xfdc) \<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. rva = [] \<longrightarrow> s \<in> ?Q'5314 cap ntfn_cap ntfn x2 rv xfdc rva (ret__unsigned_long_' s))) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5314 cap ntfn_cap ntfn x2 rv xfdc err (ret__unsigned_long_' s) (errstate s)))}
 5. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<lbrace>?R5269 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn x2\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and tcb_inv_wf' (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) and ?R5318 cap ntfn_cap ntfn x2 a\<rbrace>
 6. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5264 cap ntfn_cap ntfn x2) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) (tcb_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))\<rbrace>} \<inter> ?R'5314 cap ntfn_cap ntfn x2 rv (xfdc s)}
 7. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 8. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5264 cap ntfn_cap ntfn x)}}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 9. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 10. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?R5271 current_extra_caps cap ret__unsigned rv a ntfn x) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>cap. ?R5271 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R5269 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (12 subgoals):
 1. \<And>cap ntfn_cap ntfn x2 xfdc rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None; rva = []; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5314 cap ntfn_cap ntfn x2 () xfdc []) (?Q'5314 cap ntfn_cap ntfn x2 () xfdc [] (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>cap ntfn_cap ntfn x2 rv xfdc err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None; dc rv xfdc; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5314 cap ntfn_cap ntfn x2 rv xfdc err) (?Q''5314 cap ntfn_cap ntfn x2 rv xfdc err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 3. \<And>cap ntfn_cap ntfn x2 rv xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5318 cap ntfn_cap ntfn x2 rv\<rbrace> invokeTCB (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) \<lbrace>?Q5314 cap ntfn_cap ntfn x2 rv xfdc\<rbrace>, \<lbrace>?QE5314 cap ntfn_cap ntfn x2 rv xfdc\<rbrace>
 4. \<And>cap ntfn_cap ntfn x2 rv xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None; dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5314 cap ntfn_cap ntfn x2 rv xfdc) \<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. rva = [] \<longrightarrow> s \<in> ?Q'5314 cap ntfn_cap ntfn x2 rv xfdc rva (ret__unsigned_long_' s))) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5314 cap ntfn_cap ntfn x2 rv xfdc err (ret__unsigned_long_' s) (errstate s)))}
 5. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<lbrace>?R5269 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn x2\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and tcb_inv_wf' (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) and ?R5318 cap ntfn_cap ntfn x2 a\<rbrace>
 6. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5264 cap ntfn_cap ntfn x2) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) (tcb_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))\<rbrace>} \<inter> ?R'5314 cap ntfn_cap ntfn x2 rv (xfdc s)}
 7. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 8. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5264 cap ntfn_cap ntfn x)}}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 9. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 10. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?R5271 current_extra_caps cap ret__unsigned rv a ntfn x) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>cap. ?R5271 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R5269 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (11 subgoals):
 1. \<And>cap ntfn_cap ntfn x2 rv xfdc err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None; dc rv xfdc; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5314 cap ntfn_cap ntfn x2 rv xfdc err) (?Q''5314 cap ntfn_cap ntfn x2 rv xfdc err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 2. \<And>cap ntfn_cap ntfn x2 rv xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5318 cap ntfn_cap ntfn x2 rv\<rbrace> invokeTCB (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE5314 cap ntfn_cap ntfn x2 rv xfdc\<rbrace>
 3. \<And>cap ntfn_cap ntfn x2 rv xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None; dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5314 cap ntfn_cap ntfn x2 rv xfdc) \<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. rva = [] \<longrightarrow> s \<in> \<lbrace>id \<^bsup>s\<^esup>ret__unsigned_long = \<^bsup>s\<^esup>ret__unsigned_long \<and> dc rv (K rv \<^bsup>s\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5314 cap ntfn_cap ntfn x2 rv xfdc err (ret__unsigned_long_' s) (errstate s)))}
 4. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<lbrace>?R5269 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn x2\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and tcb_inv_wf' (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) and ?R5318 cap ntfn_cap ntfn x2 a\<rbrace>
 5. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5264 cap ntfn_cap ntfn x2) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) (tcb_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))\<rbrace>} \<inter> ?R'5314 cap ntfn_cap ntfn x2 rv (xfdc s)}
 6. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 7. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5264 cap ntfn_cap ntfn x)}}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 8. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 9. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?R5271 current_extra_caps cap ret__unsigned rv a ntfn x) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 10. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
A total of 11 subgoals...
flex-flex pairs:
\<lambda>cap. ?R5271 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R5269 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (10 subgoals):
 1. \<And>cap ntfn_cap ntfn x2 rv xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5318 cap ntfn_cap ntfn x2 rv\<rbrace> invokeTCB (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>cap ntfn_cap ntfn x2 rv xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None; dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5314 cap ntfn_cap ntfn x2 rv xfdc) \<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. rva = [] \<longrightarrow> s \<in> \<lbrace>id \<^bsup>s\<^esup>ret__unsigned_long = \<^bsup>s\<^esup>ret__unsigned_long \<and> dc rv (K rv \<^bsup>s\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> {sa. id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' s)) (errstate sa)}))}
 3. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<lbrace>?R5269 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn x2\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and tcb_inv_wf' (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) and ?R5318 cap ntfn_cap ntfn x2 a\<rbrace>
 4. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5264 cap ntfn_cap ntfn x2) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) (tcb_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))\<rbrace>} \<inter> ?R'5314 cap ntfn_cap ntfn x2 rv (xfdc s)}
 5. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 6. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5264 cap ntfn_cap ntfn x)}}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 7. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 8. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?R5271 current_extra_caps cap ret__unsigned rv a ntfn x) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 9. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 10. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R5271 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R5269 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (9 subgoals):
 1. \<And>cap ntfn_cap ntfn x2 rv xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None; dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5314 cap ntfn_cap ntfn x2 rv xfdc) \<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. rva = [] \<longrightarrow> s \<in> \<lbrace>id \<^bsup>s\<^esup>ret__unsigned_long = \<^bsup>s\<^esup>ret__unsigned_long \<and> dc rv (K rv \<^bsup>s\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> {sa. id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' s)) (errstate sa)}))}
 2. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<lbrace>?R5269 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn x2\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and tcb_inv_wf' (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) and (\<lambda>a. True \<and> True)\<rbrace>
 3. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5264 cap ntfn_cap ntfn x2) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) (tcb_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))\<rbrace>} \<inter> ?R'5314 cap ntfn_cap ntfn x2 rv (xfdc s)}
 4. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 5. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5264 cap ntfn_cap ntfn x)}}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 6. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 7. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?R5271 current_extra_caps cap ret__unsigned rv a ntfn x) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 8. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 9. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R5271 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R5269 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (8 subgoals):
 1. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<lbrace>?R5269 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn x2\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and tcb_inv_wf' (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) and (\<lambda>a. True \<and> True)\<rbrace>
 2. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5264 cap ntfn_cap ntfn x2) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) (tcb_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))}}
 3. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 4. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5264 cap ntfn_cap ntfn x)}}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 5. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 6. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?R5271 current_extra_caps cap ret__unsigned rv a ntfn x) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 7. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 8. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R5271 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R5269 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (8 subgoals):
 1. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<lbrace>?R5269 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn x2\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a b. invs' b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ko. ntfnBoundTCB ko = None \<and> (\<forall>q. ntfnObj ko \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) b \<and> ex_nonz_cap_to' (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) b \<and> bound_tcb_at' ((=) None) (capTCBPtr cp) b\<rbrace>
 2. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5264 cap ntfn_cap ntfn x2) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))) (tcb_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) s) \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap))\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))}}
 3. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 4. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5264 cap ntfn_cap ntfn x)}}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 5. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 6. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?R5271 current_extra_caps cap ret__unsigned rv a ntfn x) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 7. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 8. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R5271 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R5269 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (7 subgoals):
 1. \<And>cap ntfn_cap ntfn x2. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2; ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5264 cap ntfn_cap ntfn x2) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})
 2. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 3. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5264 cap ntfn_cap ntfn x)}}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 4. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 5. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 6. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 7. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (6 subgoals):
 1. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (do a <- throw Fault_H.syscall_error.IllegalOperation;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rv \<Rightarrow> returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (ntfnObj ntfn) THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 3. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 4. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 5. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 6. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (6 subgoals):
 1. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4941 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R''4933 cap ntfn_cap ntfn x3) [SKIP] (throwError (Inl Fault_H.syscall_error.IllegalOperation)) (Cond (if (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.WaitingNtfn x3) then UNIV else {}) (\<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)) SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''4933 cap ntfn_cap ntfn x}})})
 3. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 4. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 5. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 6. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None \<equiv>\<^sup>? \<lambda>cap rva. ?R4941 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (6 subgoals):
 1. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R5488 cap (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) True (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn a x3) (?R'5485 cap ntfn_cap ntfn x3) [SKIP] (throwError (Inl Fault_H.syscall_error.IllegalOperation)) (\<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R'5485 cap ntfn_cap ntfn x \<inter> (if (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.WaitingNtfn x) then UNIV else {})}})})
 3. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 4. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R4944 current_extra_caps cap ret__unsigned rv a ntfn b x)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 5. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 6. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap rva. ?R5488 cap rva (capNtfnPtr rva) (capNtfnCanReceive rva) rva \<equiv>\<^sup>? \<lambda>cap. ?R4944 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (7 subgoals):
 1. \<And>cap ntfn_cap ntfn x3. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5489 cap ntfn_cap ntfn x3) \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 2. \<And>cap ntfn_cap ntfn x3 \<sigma>. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (throwError (Inl Fault_H.syscall_error.IllegalOperation) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 3. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> UNIV \<inter> ?R'5489 cap ntfn_cap ntfn x \<inter> (if (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.WaitingNtfn x) then UNIV else {})}})})
 4. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 5. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> capNtfnCanReceive a)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 6. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 7. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (6 subgoals):
 1. \<And>cap ntfn_cap ntfn x3 \<sigma>. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (throwError (Inl Fault_H.syscall_error.IllegalOperation) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> (if (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.WaitingNtfn x) then UNIV else {})}})})
 3. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 4. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> capNtfnCanReceive a)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 5. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 6. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (6 subgoals):
 1. \<And>cap ntfn_cap ntfn x3 \<sigma>. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (throwError (Inl Fault_H.syscall_error.IllegalOperation) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))}
 2. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> (if (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.WaitingNtfn x) then UNIV else {})}})})
 3. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 4. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> capNtfnCanReceive a)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 5. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 6. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (5 subgoals):
 1. \<And>cap ntfn_cap ntfn. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True) ntfn_cap; cap_get_tag ntfn_cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfn_cap)) (capNtfnCanSend_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0) True; capNtfnCanReceive_CL (cap_notification_cap_lift ntfn_cap) \<noteq> 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (ntfnBoundTCB ntfn \<noteq> None \<or> isWaitingNtfn (ntfnObj ntfn))) ret__int_' (\<lambda>rv rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> {s. ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) then UNIV else {})})}}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> (if (\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.WaitingNtfn x) then UNIV else {})}})})
 2. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 3. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> capNtfnCanReceive a)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 4. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 5. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (4 subgoals):
 1. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation rva ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None rva ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (doE a <- case fst (hd extraCaps) of capability.NotificationCap ptr v12 v13 recv \<Rightarrow> returnOk (ptr, recv) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case a of (ntfnPtr, rights) \<Rightarrow> doE y <- if \<not> rights then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
do notification <- getNotification ntfnPtr;
doE y <- case ntfnObj notification of Structures_H.ntfn.WaitingNtfn list \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> case ntfnBoundTCB notification of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.NotificationControl (capTCBPtr cp) (Some ntfnPtr))
odE
od
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr ret__unsigneda,\<acute>ntfnPtr);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 2. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> capNtfnCanReceive a)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 3. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 4. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (4 subgoals):
 1. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation (fst (extraCaps ! 0)) ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3807 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None (fst (extraCaps ! 0))) (?T3809 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None (fst (extraCaps ! 0)) ntfn_cap (cap_get_tag ntfn_cap)) [SKIP] (throwError (Inl Fault_H.syscall_error.IllegalOperation)) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(ntfn_cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(\<acute>ntfnPtr);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_NotificationControl_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 2. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> capNtfnCanReceive a)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> ?R3807 current_extra_caps cap ret__unsigned rv a b)\<rbrace>
 3. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> ?T3809 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 4. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (5 subgoals):
 1. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation (fst (extraCaps ! 0)) ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5520 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) None (fst (extraCaps ! 0)) ntfn_cap (cap_get_tag ntfn_cap)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 2. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned \<sigma>. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation (fst (extraCaps ! 0)) ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (throwError (Inl Fault_H.syscall_error.IllegalOperation) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 3. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> capNtfnCanReceive a)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> True)\<rbrace>
 4. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rva \<longrightarrow> sa \<in> UNIV \<inter> ?R'5520 current_extra_caps cap ret__unsigned rv rva (ntfn_cap_' s) v)}}}}
 5. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (4 subgoals):
 1. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned \<sigma>. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation (fst (extraCaps ! 0)) ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (throwError (Inl Fault_H.syscall_error.IllegalOperation) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> capNtfnCanReceive a)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> True)\<rbrace>
 3. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rv = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rv \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>)}}}}
 4. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (4 subgoals):
 1. \<And>current_extra_caps cap ret__unsigneda rv rva ntfn_cap ret__unsigned \<sigma>. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None; ccap_relation (fst (extraCaps ! 0)) ntfn_cap; ret__unsigned = cap_get_tag ntfn_cap; rva = fst (extraCaps ! 0); \<not> isNotificationCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (throwError (Inl Fault_H.syscall_error.IllegalOperation) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))}
 2. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> capNtfnCanReceive a)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> True)\<rbrace>
 3. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rv = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rv \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>)}}}}
 4. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (3 subgoals):
 1. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isNotificationCap a \<longrightarrow> (\<not> capNtfnCanReceive a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ((\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn Structures_H.ntfn.IdleNtfn) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> capNtfnCanReceive a) \<and> (\<not> ((\<exists>y. ntfnBoundTCB ntfn = Some y) \<or> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)) \<longrightarrow> ((\<lambda>b. obj_at' (\<lambda>x. capNtfnCanReceive a) thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = rv \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr a) b \<and> ex_nonz_cap_to' (capNtfnPtr a) b \<and> bound_tcb_at' ((=) rv) (capTCBPtr cp) b)) b)) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> capNtfnCanReceive a)) and (ko_at' ntfn (capNtfnPtr a) and valid_ntfn' ntfn)) b))) \<and> (\<not> isNotificationCap a \<longrightarrow> True)\<rbrace>
 2. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rv = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rv \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>)}}}}
 3. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (3 subgoals):
 1. \<And>cap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; ccap_relation cp cap; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3060 cap None\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> isNotificationCap (fst (extraCaps ! 0)) \<longrightarrow> capNtfnCanReceive (fst (extraCaps ! 0)) \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr (fst (extraCaps ! 0))) b \<longrightarrow> ksCurThread b = thread \<and> (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ntfnBoundTCB ntfn = None \<and> \<not> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> (obj_at' tcbQueued thread b \<longrightarrow> st_tcb_at' runnable' thread b) \<and> sch_act_simple b \<and> invs' b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = None \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr (fst (extraCaps ! 0))) b \<and> ex_nonz_cap_to' (capNtfnPtr (fst (extraCaps ! 0))) b \<and> bound_tcb_at' ((=) None) (capTCBPtr cp) b) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ntfnBoundTCB ntfn = None \<and> \<not> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> (obj_at' tcbQueued thread b \<longrightarrow> st_tcb_at' runnable' thread b) \<and> sch_act_simple b \<and> invs' b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = None \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr (fst (extraCaps ! 0))) b \<and> ex_nonz_cap_to' (capNtfnPtr (fst (extraCaps ! 0))) b \<and> bound_tcb_at' ((=) None) (capTCBPtr cp) b) \<and> valid_ntfn' ntfn b)\<rbrace>
 2. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (ntfn_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rv = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isNotificationCap rv \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (\<not> to_bool v \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> to_bool v \<longrightarrow> s \<in> {s'. \<forall>ntfn s. (s, s') \<in> rf_sr \<and> ko_at' ntfn va s \<longrightarrow> s' \<in> UNIV})}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = v}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfn_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>)}}}}
 3. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3064 current_extra_caps cap tcb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb)
?R3064 extraCaps' \<equiv>\<^sup>? \<lambda>cap tcb. ?R3060 cap (tcbBoundNotification tcb) proof (prove)
goal (2 subgoals):
 1. \<And>current_extra_caps cap ret__unsigned rv. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; extraCaps \<noteq> []; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3050 cap None) \<acute>ntfn_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. ccap_relation (fst (extraCaps ! 0)) (ntfn_cap_' s) \<longrightarrow> isNotificationCap (fst (extraCaps ! 0)) \<longrightarrow> s\<lparr>ret__unsigned_' := cap_get_tag (ntfn_cap_' s)\<rparr> \<in> (if cap_get_tag (ntfn_cap_' s) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})}
 2. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. isNotificationCap (fst (extraCaps ! 0)) \<longrightarrow> capNtfnCanReceive (fst (extraCaps ! 0)) \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr (fst (extraCaps ! 0))) a \<longrightarrow> ksCurThread a = thread \<and> (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ntfnBoundTCB ntfn = None \<and> \<not> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = None \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr (fst (extraCaps ! 0))) a \<and> ex_nonz_cap_to' (capNtfnPtr (fst (extraCaps ! 0))) a \<and> bound_tcb_at' ((=) None) (capTCBPtr cp) a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ntfnBoundTCB ntfn = None \<and> \<not> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = None \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr (fst (extraCaps ! 0))) a \<and> ex_nonz_cap_to' (capNtfnPtr (fst (extraCaps ! 0))) a \<and> bound_tcb_at' ((=) None) (capTCBPtr cp) a) \<and> valid_ntfn' ntfn a)) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3056 current_extra_caps cap v tcb \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}
flex-flex pairs:
\<lambda>cap. ?R'3056 extraCaps' cap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap tcb. ?R'3050 cap (tcbBoundNotification tcb) proof (prove)
goal (1 subgoal):
 1. \<And>current_extra_caps cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; isThreadCap cp; current_extra_caps = extraCaps'; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> ((\<lambda>s. tcbBoundNotification tcb \<noteq> Some 0) and (\<lambda>a. (tcbBoundNotification tcb = None \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. isNotificationCap (fst (extraCaps ! 0)) \<longrightarrow> capNtfnCanReceive (fst (extraCaps ! 0)) \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr (fst (extraCaps ! 0))) a \<longrightarrow> ksCurThread a = thread \<and> (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ntfnBoundTCB ntfn = None \<and> \<not> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = None \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr (fst (extraCaps ! 0))) a \<and> ex_nonz_cap_to' (capNtfnPtr (fst (extraCaps ! 0))) a \<and> bound_tcb_at' ((=) None) (capTCBPtr cp) a) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ntfnBoundTCB ntfn = None \<and> \<not> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = None \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr (fst (extraCaps ! 0))) a \<and> ex_nonz_cap_to' (capNtfnPtr (fst (extraCaps ! 0))) a \<and> bound_tcb_at' ((=) None) (capTCBPtr cp) a) \<and> valid_ntfn' ntfn a)) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) a) \<and> (\<forall>x. tcbBoundNotification tcb = Some x \<longrightarrow> True))) s))) \<and> s' \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. tcb_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> s' \<in> {s. tcbBoundNotification tcb = None \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> {s. ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isNotificationCap (fst (extraCaps ! 0)) \<longrightarrow> s\<lparr>ntfn_cap_' := h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])), ret__unsigned_' := cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])))\<rparr> \<in> (if cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})} \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. tcbBoundNotification tcb = Some x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(notification_C ptr) &(tcb_Ptr v\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL\<rbrace>}}}} \<inter> {s. s \<Turnstile>\<^sub>c tcb_Ptr v}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})} proof (prove)
goal (1 subgoal):
 1. \<And>cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s)\<rbrakk> \<Longrightarrow> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> tcbBoundNotification tcb \<noteq> Some 0 \<and> (tcbBoundNotification tcb = None \<longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> (isNotificationCap (fst (extraCaps ! 0)) \<longrightarrow> capNtfnCanReceive (fst (extraCaps ! 0)) \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr (fst (extraCaps ! 0))) s \<longrightarrow> (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ntfnBoundTCB ntfn = None \<and> \<not> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = None \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr (fst (extraCaps ! 0))) s \<and> ex_nonz_cap_to' (capNtfnPtr (fst (extraCaps ! 0))) s \<and> bound_tcb_at' ((=) None) (capTCBPtr cp) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ntfnBoundTCB ntfn = None \<and> \<not> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = None \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr (fst (extraCaps ! 0))) s \<and> ex_nonz_cap_to' (capNtfnPtr (fst (extraCaps ! 0))) s \<and> bound_tcb_at' ((=) None) (capTCBPtr cp) s) \<and> valid_ntfn' ntfn s)) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s) \<and> extraCaps \<noteq> []))) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> (tcbBoundNotification tcb = None \<longrightarrow> tcb_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) (s'\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rparr>) \<in> (if excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) then UNIV else {}) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isNotificationCap (fst (extraCaps ! 0)) \<longrightarrow> s'\<lparr>tcb_' := tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)), ntfn_cap_' := h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])), ret__unsigned_' := cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])))\<rparr> \<in> (if cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})) \<and> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) = NULL) \<and> ((\<exists>x. tcbBoundNotification tcb = Some x) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL)) \<and> s' \<Turnstile>\<^sub>c tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<and> s' \<in> (if cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {})) proof (prove)
goal (2 subgoals):
 1. \<And>cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s)\<rbrakk> \<Longrightarrow> excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr cp) s \<longrightarrow> tcbBoundNotification tcb \<noteq> Some 0 \<and> (tcbBoundNotification tcb = None \<longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> (isNotificationCap (fst (extraCaps ! 0)) \<longrightarrow> capNtfnCanReceive (fst (extraCaps ! 0)) \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr (fst (extraCaps ! 0))) s \<longrightarrow> (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ntfnBoundTCB ntfn = None \<and> \<not> isWaitingNtfn Structures_H.ntfn.IdleNtfn \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = None \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr (fst (extraCaps ! 0))) s \<and> ex_nonz_cap_to' (capNtfnPtr (fst (extraCaps ! 0))) s \<and> bound_tcb_at' ((=) None) (capTCBPtr cp) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ntfnBoundTCB ntfn = None \<and> \<not> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x) \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = None \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr (fst (extraCaps ! 0))) s \<and> ex_nonz_cap_to' (capNtfnPtr (fst (extraCaps ! 0))) s \<and> bound_tcb_at' ((=) None) (capTCBPtr cp) s) \<and> valid_ntfn' ntfn s)) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s) \<and> extraCaps \<noteq> []))
 2. \<And>cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s)\<rbrakk> \<Longrightarrow> excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> (tcbBoundNotification tcb = None \<longrightarrow> tcb_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) (s'\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rparr>) \<in> (if excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) then UNIV else {}) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isNotificationCap (fst (extraCaps ! 0)) \<longrightarrow> s'\<lparr>tcb_' := tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)), ntfn_cap_' := h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])), ret__unsigned_' := cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])))\<rparr> \<in> (if cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})) \<and> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) = NULL) \<and> ((\<exists>x. tcbBoundNotification tcb = Some x) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL)) \<and> s' \<Turnstile>\<^sub>c tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<and> s' \<in> (if cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {}) proof (prove)
goal (17 subgoals):
 1. \<And>cap s s' tcb. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); excaps_map extraCaps \<noteq> []; ko_at' tcb (capTCBPtr cp) s; tcbBoundNotification tcb = Some 0\<rbrakk> \<Longrightarrow> False
 2. \<And>cap s s' tcb ntfn. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); excaps_map extraCaps \<noteq> []; ko_at' tcb (capTCBPtr cp) s; tcbBoundNotification tcb = None; cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s; isNotificationCap (fst (extraCaps ! 0)); capNtfnCanReceive (fst (extraCaps ! 0)); ko_at' ntfn (capNtfnPtr (fst (extraCaps ! 0))) s; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None; \<not> isWaitingNtfn Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> valid_tcb_state' Structures_H.thread_state.Restart s
 3. \<And>cap s s' tcb ntfn. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); excaps_map extraCaps \<noteq> []; ko_at' tcb (capTCBPtr cp) s; tcbBoundNotification tcb = None; cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s; isNotificationCap (fst (extraCaps ! 0)); capNtfnCanReceive (fst (extraCaps ! 0)); ko_at' ntfn (capNtfnPtr (fst (extraCaps ! 0))) s; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None; \<not> isWaitingNtfn Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s
 4. \<And>cap s s' tcb ntfn. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); excaps_map extraCaps \<noteq> []; ko_at' tcb (capTCBPtr cp) s; tcbBoundNotification tcb = None; cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s; isNotificationCap (fst (extraCaps ! 0)); capNtfnCanReceive (fst (extraCaps ! 0)); ko_at' ntfn (capNtfnPtr (fst (extraCaps ! 0))) s; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None; \<not> isWaitingNtfn Structures_H.ntfn.IdleNtfn; obj_at' tcbQueued (ksCurThread s) s\<rbrakk> \<Longrightarrow> st_tcb_at' runnable' (ksCurThread s) s
 5. \<And>cap s s' tcb ntfn. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); excaps_map extraCaps \<noteq> []; ko_at' tcb (capTCBPtr cp) s; tcbBoundNotification tcb = None; cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s; isNotificationCap (fst (extraCaps ! 0)); capNtfnCanReceive (fst (extraCaps ! 0)); ko_at' ntfn (capNtfnPtr (fst (extraCaps ! 0))) s; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None; \<not> isWaitingNtfn Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = None \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr (fst (extraCaps ! 0))) s
 6. \<And>cap s s' tcb ntfn. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); excaps_map extraCaps \<noteq> []; ko_at' tcb (capTCBPtr cp) s; tcbBoundNotification tcb = None; cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s; isNotificationCap (fst (extraCaps ! 0)); capNtfnCanReceive (fst (extraCaps ! 0)); ko_at' ntfn (capNtfnPtr (fst (extraCaps ! 0))) s; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None; \<not> isWaitingNtfn Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' (capNtfnPtr (fst (extraCaps ! 0))) s
 7. \<And>cap s s' tcb ntfn. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); excaps_map extraCaps \<noteq> []; ko_at' tcb (capTCBPtr cp) s; tcbBoundNotification tcb = None; cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s; isNotificationCap (fst (extraCaps ! 0)); capNtfnCanReceive (fst (extraCaps ! 0)); ko_at' ntfn (capNtfnPtr (fst (extraCaps ! 0))) s; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None; \<not> isWaitingNtfn Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> bound_tcb_at' ((=) None) (capTCBPtr cp) s
 8. \<And>cap s s' tcb ntfn x. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); excaps_map extraCaps \<noteq> []; ko_at' tcb (capTCBPtr cp) s; tcbBoundNotification tcb = None; cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s; isNotificationCap (fst (extraCaps ! 0)); capNtfnCanReceive (fst (extraCaps ! 0)); ko_at' ntfn (capNtfnPtr (fst (extraCaps ! 0))) s; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x; ntfnBoundTCB ntfn = None; \<not> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)\<rbrakk> \<Longrightarrow> valid_tcb_state' Structures_H.thread_state.Restart s
 9. \<And>cap s s' tcb ntfn x. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); excaps_map extraCaps \<noteq> []; ko_at' tcb (capTCBPtr cp) s; tcbBoundNotification tcb = None; cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s; isNotificationCap (fst (extraCaps ! 0)); capNtfnCanReceive (fst (extraCaps ! 0)); ko_at' ntfn (capNtfnPtr (fst (extraCaps ! 0))) s; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x; ntfnBoundTCB ntfn = None; \<not> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)\<rbrakk> \<Longrightarrow> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s
 10. \<And>cap s s' tcb ntfn x. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); excaps_map extraCaps \<noteq> []; ko_at' tcb (capTCBPtr cp) s; tcbBoundNotification tcb = None; cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s; isNotificationCap (fst (extraCaps ! 0)); capNtfnCanReceive (fst (extraCaps ! 0)); ko_at' ntfn (capNtfnPtr (fst (extraCaps ! 0))) s; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x; ntfnBoundTCB ntfn = None; \<not> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x); obj_at' tcbQueued (ksCurThread s) s\<rbrakk> \<Longrightarrow> st_tcb_at' runnable' (ksCurThread s) s
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>cap s s' tcb ntfn. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); excaps_map extraCaps \<noteq> []; ko_at' tcb (capTCBPtr cp) s; tcbBoundNotification tcb = None; cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s; isNotificationCap (fst (extraCaps ! 0)); capNtfnCanReceive (fst (extraCaps ! 0)); ko_at' ntfn (capNtfnPtr (fst (extraCaps ! 0))) s; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None; \<not> isWaitingNtfn Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> valid_tcb_state' Structures_H.thread_state.Restart s
 2. \<And>cap s s' tcb ntfn. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); excaps_map extraCaps \<noteq> []; ko_at' tcb (capTCBPtr cp) s; tcbBoundNotification tcb = None; cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s; isNotificationCap (fst (extraCaps ! 0)); capNtfnCanReceive (fst (extraCaps ! 0)); ko_at' ntfn (capNtfnPtr (fst (extraCaps ! 0))) s; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None; \<not> isWaitingNtfn Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s
 3. \<And>cap s s' tcb ntfn. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); excaps_map extraCaps \<noteq> []; ko_at' tcb (capTCBPtr cp) s; tcbBoundNotification tcb = None; cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s; isNotificationCap (fst (extraCaps ! 0)); capNtfnCanReceive (fst (extraCaps ! 0)); ko_at' ntfn (capNtfnPtr (fst (extraCaps ! 0))) s; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None; \<not> isWaitingNtfn Structures_H.ntfn.IdleNtfn; obj_at' tcbQueued (ksCurThread s) s\<rbrakk> \<Longrightarrow> st_tcb_at' runnable' (ksCurThread s) s
 4. \<And>cap s s' tcb ntfn. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); excaps_map extraCaps \<noteq> []; ko_at' tcb (capTCBPtr cp) s; tcbBoundNotification tcb = None; cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s; isNotificationCap (fst (extraCaps ! 0)); capNtfnCanReceive (fst (extraCaps ! 0)); ko_at' ntfn (capNtfnPtr (fst (extraCaps ! 0))) s; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None; \<not> isWaitingNtfn Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = None \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr (fst (extraCaps ! 0))) s
 5. \<And>cap s s' tcb ntfn. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); excaps_map extraCaps \<noteq> []; ko_at' tcb (capTCBPtr cp) s; tcbBoundNotification tcb = None; cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s; isNotificationCap (fst (extraCaps ! 0)); capNtfnCanReceive (fst (extraCaps ! 0)); ko_at' ntfn (capNtfnPtr (fst (extraCaps ! 0))) s; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None; \<not> isWaitingNtfn Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' (capNtfnPtr (fst (extraCaps ! 0))) s
 6. \<And>cap s s' tcb ntfn. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); excaps_map extraCaps \<noteq> []; ko_at' tcb (capTCBPtr cp) s; tcbBoundNotification tcb = None; cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s; isNotificationCap (fst (extraCaps ! 0)); capNtfnCanReceive (fst (extraCaps ! 0)); ko_at' ntfn (capNtfnPtr (fst (extraCaps ! 0))) s; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; ntfnBoundTCB ntfn = None; \<not> isWaitingNtfn Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> bound_tcb_at' ((=) None) (capTCBPtr cp) s
 7. \<And>cap s s' tcb ntfn x. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); excaps_map extraCaps \<noteq> []; ko_at' tcb (capTCBPtr cp) s; tcbBoundNotification tcb = None; cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s; isNotificationCap (fst (extraCaps ! 0)); capNtfnCanReceive (fst (extraCaps ! 0)); ko_at' ntfn (capNtfnPtr (fst (extraCaps ! 0))) s; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x; ntfnBoundTCB ntfn = None; \<not> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)\<rbrakk> \<Longrightarrow> valid_tcb_state' Structures_H.thread_state.Restart s
 8. \<And>cap s s' tcb ntfn x. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); excaps_map extraCaps \<noteq> []; ko_at' tcb (capTCBPtr cp) s; tcbBoundNotification tcb = None; cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s; isNotificationCap (fst (extraCaps ! 0)); capNtfnCanReceive (fst (extraCaps ! 0)); ko_at' ntfn (capNtfnPtr (fst (extraCaps ! 0))) s; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x; ntfnBoundTCB ntfn = None; \<not> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)\<rbrakk> \<Longrightarrow> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s
 9. \<And>cap s s' tcb ntfn x. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); excaps_map extraCaps \<noteq> []; ko_at' tcb (capTCBPtr cp) s; tcbBoundNotification tcb = None; cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s; isNotificationCap (fst (extraCaps ! 0)); capNtfnCanReceive (fst (extraCaps ! 0)); ko_at' ntfn (capNtfnPtr (fst (extraCaps ! 0))) s; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x; ntfnBoundTCB ntfn = None; \<not> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x); obj_at' tcbQueued (ksCurThread s) s\<rbrakk> \<Longrightarrow> st_tcb_at' runnable' (ksCurThread s) s
 10. \<And>cap s s' tcb ntfn x. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); excaps_map extraCaps \<noteq> []; ko_at' tcb (capTCBPtr cp) s; tcbBoundNotification tcb = None; cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s; isNotificationCap (fst (extraCaps ! 0)); capNtfnCanReceive (fst (extraCaps ! 0)); ko_at' ntfn (capNtfnPtr (fst (extraCaps ! 0))) s; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x; ntfnBoundTCB ntfn = None; \<not> isWaitingNtfn (Structures_H.ntfn.ActiveNtfn x)\<rbrakk> \<Longrightarrow> obj_at' (\<lambda>ntfn. ntfnBoundTCB ntfn = None \<and> (\<forall>q. ntfnObj ntfn \<noteq> Structures_H.ntfn.WaitingNtfn q)) (capNtfnPtr (fst (extraCaps ! 0))) s
A total of 16 subgoals... proof (prove)
goal (4 subgoals):
 1. \<And>cap s s' tcb ntfn. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); excaps_map extraCaps \<noteq> []; ko_at' tcb (capTCBPtr cp) s; tcbBoundNotification tcb = None; cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s; isNotificationCap (fst (extraCaps ! 0)); capNtfnCanReceive (fst (extraCaps ! 0)); ko_at' ntfn (capNtfnPtr (fst (extraCaps ! 0))) s\<rbrakk> \<Longrightarrow> valid_ntfn' ntfn s
 2. \<And>cap s s' tcb. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); excaps_map extraCaps \<noteq> []; ko_at' tcb (capTCBPtr cp) s; tcbBoundNotification tcb = None; cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s
 3. \<And>cap s s' tcb. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map []; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set []. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem [] (ctes_of s); excaps_map [] \<noteq> []; ko_at' tcb (capTCBPtr cp) s; tcbBoundNotification tcb = None; extraCaps = []\<rbrakk> \<Longrightarrow> False
 4. \<And>cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s)\<rbrakk> \<Longrightarrow> excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> (tcbBoundNotification tcb = None \<longrightarrow> tcb_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) (s'\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rparr>) \<in> (if excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) then UNIV else {}) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isNotificationCap (fst (extraCaps ! 0)) \<longrightarrow> s'\<lparr>tcb_' := tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)), ntfn_cap_' := h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])), ret__unsigned_' := cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])))\<rparr> \<in> (if cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})) \<and> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) = NULL) \<and> ((\<exists>x. tcbBoundNotification tcb = Some x) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL)) \<and> s' \<Turnstile>\<^sub>c tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<and> s' \<in> (if cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {}) proof (prove)
goal (3 subgoals):
 1. \<And>cap s s' tcb. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); excaps_map extraCaps \<noteq> []; ko_at' tcb (capTCBPtr cp) s; tcbBoundNotification tcb = None; cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s
 2. \<And>cap s s' tcb. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map []; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set []. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem [] (ctes_of s); excaps_map [] \<noteq> []; ko_at' tcb (capTCBPtr cp) s; tcbBoundNotification tcb = None; extraCaps = []\<rbrakk> \<Longrightarrow> False
 3. \<And>cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s)\<rbrakk> \<Longrightarrow> excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> (tcbBoundNotification tcb = None \<longrightarrow> tcb_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) (s'\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rparr>) \<in> (if excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) then UNIV else {}) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isNotificationCap (fst (extraCaps ! 0)) \<longrightarrow> s'\<lparr>tcb_' := tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)), ntfn_cap_' := h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])), ret__unsigned_' := cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])))\<rparr> \<in> (if cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})) \<and> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) = NULL) \<and> ((\<exists>x. tcbBoundNotification tcb = Some x) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL)) \<and> s' \<Turnstile>\<^sub>c tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<and> s' \<in> (if cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {}) proof (prove)
goal (2 subgoals):
 1. \<And>cap s s' tcb. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map []; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set []. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem [] (ctes_of s); excaps_map [] \<noteq> []; ko_at' tcb (capTCBPtr cp) s; tcbBoundNotification tcb = None; extraCaps = []\<rbrakk> \<Longrightarrow> False
 2. \<And>cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s)\<rbrakk> \<Longrightarrow> excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> (tcbBoundNotification tcb = None \<longrightarrow> tcb_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) (s'\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rparr>) \<in> (if excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) then UNIV else {}) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isNotificationCap (fst (extraCaps ! 0)) \<longrightarrow> s'\<lparr>tcb_' := tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)), ntfn_cap_' := h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])), ret__unsigned_' := cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])))\<rparr> \<in> (if cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})) \<and> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) = NULL) \<and> ((\<exists>x. tcbBoundNotification tcb = Some x) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL)) \<and> s' \<Turnstile>\<^sub>c tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<and> s' \<in> (if cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {}) proof (prove)
goal (1 subgoal):
 1. \<And>cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s)\<rbrakk> \<Longrightarrow> excaps_map extraCaps \<noteq> [] \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> (tcbBoundNotification tcb = None \<longrightarrow> tcb_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) (s'\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rparr>) \<in> (if excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) then UNIV else {}) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isNotificationCap (fst (extraCaps ! 0)) \<longrightarrow> s'\<lparr>tcb_' := tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)), ntfn_cap_' := h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])), ret__unsigned_' := cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])))\<rparr> \<in> (if cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})) \<and> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) = NULL) \<and> ((\<exists>x. tcbBoundNotification tcb = Some x) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL)) \<and> s' \<Turnstile>\<^sub>c tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<and> s' \<in> (if cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {}) proof (prove)
goal (1 subgoal):
 1. \<And>cap s s' ko. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); ko_at' ko (capTCBPtr cp) s; excaps_map extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> (tcbBoundNotification tcb = None \<longrightarrow> tcb_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) (s'\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rparr>) \<in> (if excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) then UNIV else {}) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isNotificationCap (fst (extraCaps ! 0)) \<longrightarrow> s'\<lparr>tcb_' := tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)), ntfn_cap_' := h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])), ret__unsigned_' := cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])))\<rparr> \<in> (if cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})) \<and> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) = NULL) \<and> ((\<exists>x. tcbBoundNotification tcb = Some x) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL)) \<and> s' \<Turnstile>\<^sub>c tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<and> s' \<in> (if cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {}) proof (prove)
goal (2 subgoals):
 1. \<And>cap s s' ko. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); ko_at' ko (capTCBPtr cp) s; excaps_map extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> map_to_tcbs (ksPSpace s) (?x5968 cap s s' ko) = Some (?y5968 cap s s' ko)
 2. \<And>cap s s' ko y'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); ko_at' ko (capTCBPtr cp) s; excaps_map extraCaps \<noteq> []; map_to_tcbs (ksPSpace s) (?x5968 cap s s' ko) = Some (?y5968 cap s s' ko); ctcb_relation (?y5968 cap s s' ko) y'; cslift s' (tcb_ptr_to_ctcb_ptr (?x5968 cap s s' ko)) = Some y'\<rbrakk> \<Longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> (tcbBoundNotification tcb = None \<longrightarrow> tcb_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) (s'\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rparr>) \<in> (if excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) then UNIV else {}) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isNotificationCap (fst (extraCaps ! 0)) \<longrightarrow> s'\<lparr>tcb_' := tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)), ntfn_cap_' := h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])), ret__unsigned_' := cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])))\<rparr> \<in> (if cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})) \<and> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) = NULL) \<and> ((\<exists>x. tcbBoundNotification tcb = Some x) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL)) \<and> s' \<Turnstile>\<^sub>c tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<and> s' \<in> (if cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {}) proof (prove)
goal (1 subgoal):
 1. \<And>cap s s' ko y'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; isThreadCap cp; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); ko_at' ko (capTCBPtr cp) s; excaps_map extraCaps \<noteq> []; map_to_tcbs (ksPSpace s) (capTCBPtr cp) = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some y'\<rbrakk> \<Longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> (tcbBoundNotification tcb = None \<longrightarrow> tcb_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) (s'\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rparr>) \<in> (if excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) then UNIV else {}) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isNotificationCap (fst (extraCaps ! 0)) \<longrightarrow> s'\<lparr>tcb_' := tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)), ntfn_cap_' := h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])), ret__unsigned_' := cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])))\<rparr> \<in> (if cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})) \<and> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) = NULL) \<and> ((\<exists>x. tcbBoundNotification tcb = Some x) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL)) \<and> s' \<Turnstile>\<^sub>c tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<and> s' \<in> (if cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {}) proof (prove)
goal (1 subgoal):
 1. \<And>cap s s' ko y' v0. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' (capability.ThreadCap v0) s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); ko_at' ko v0 s; excaps_map extraCaps \<noteq> []; map_to_tcbs (ksPSpace s) v0 = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr v0) = Some y'; cp = capability.ThreadCap v0\<rbrakk> \<Longrightarrow> (\<forall>tcb. ctcb_relation tcb y' \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> (tcbBoundNotification tcb = None \<longrightarrow> tcb_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) (s'\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rparr>) \<in> (if excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) then UNIV else {}) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (\<exists>v0 v1 v2 v3. fst (extraCaps ! 0) = capability.NotificationCap v0 v1 v2 v3) \<longrightarrow> s'\<lparr>tcb_' := tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)), ntfn_cap_' := h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])), ret__unsigned_' := cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])))\<rparr> \<in> (if cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})) \<and> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) = NULL) \<and> ((\<exists>x. tcbBoundNotification tcb = Some x) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL)) \<and> s' \<Turnstile>\<^sub>c tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<and> s' \<in> (if cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {}) proof (prove)
goal (1 subgoal):
 1. \<And>cap s s' ko y' v0. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' (capability.ThreadCap v0) s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); ko_at' ko v0 s; excaps_map extraCaps \<noteq> []; map_to_tcbs (ksPSpace s) v0 = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr v0) = Some y'; cp = capability.ThreadCap v0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrakk> \<Longrightarrow> (\<forall>tcb. ctcb_relation tcb y' \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<and> tcbBoundNotification tcb \<noteq> Some 0 \<longrightarrow> (tcbBoundNotification tcb = None \<longrightarrow> tcb_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) (s'\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rparr>) \<in> (if excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) then UNIV else {}) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (\<exists>v0 v1 v2 v3. fst (extraCaps ! 0) = capability.NotificationCap v0 v1 v2 v3) \<longrightarrow> s'\<lparr>tcb_' := tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)), ntfn_cap_' := h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])), ret__unsigned_' := cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])))\<rparr> \<in> (if cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})) \<and> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) = NULL) \<and> ((\<exists>x. tcbBoundNotification tcb = Some x) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) \<noteq> NULL)) \<and> s' \<Turnstile>\<^sub>c tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<and> s' \<in> (if cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {}) proof (prove)
goal (6 subgoals):
 1. \<And>cap s s' ko y' v0 tcb sa. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' (capability.ThreadCap v0) s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); ko_at' ko v0 s; excaps_map extraCaps \<noteq> []; map_to_tcbs (ksPSpace s) v0 = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr v0) = Some y'; cp = capability.ThreadCap v0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ctcb_relation tcb y'; tcbBoundNotification tcb \<noteq> Some 0; (sa, s') \<in> rf_sr; tcbBoundNotification tcb = None\<rbrakk> \<Longrightarrow> tcb_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) (s'\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rparr>) \<in> (if excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) then UNIV else {})
 2. \<And>cap s s' ko y' v0 tcb sa v0a v1 v2 v3. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' (capability.ThreadCap v0) s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); ko_at' ko v0 s; excaps_map extraCaps \<noteq> []; map_to_tcbs (ksPSpace s) v0 = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr v0) = Some y'; cp = capability.ThreadCap v0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ctcb_relation tcb y'; tcbBoundNotification tcb \<noteq> Some 0; (sa, s') \<in> rf_sr; tcbBoundNotification tcb = None; ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))); fst (extraCaps ! 0) = capability.NotificationCap v0a v1 v2 v3\<rbrakk> \<Longrightarrow> s'\<lparr>tcb_' := tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)), ntfn_cap_' := h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])), ret__unsigned_' := cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])))\<rparr> \<in> (if cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})
 3. \<And>cap s s' ko y' v0 tcb sa. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' (capability.ThreadCap v0) s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); ko_at' ko v0 s; excaps_map extraCaps \<noteq> []; map_to_tcbs (ksPSpace s) v0 = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr v0) = Some y'; cp = capability.ThreadCap v0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ctcb_relation tcb y'; tcbBoundNotification tcb \<noteq> Some 0; (sa, s') \<in> rf_sr; tcbBoundNotification tcb = None\<rbrakk> \<Longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) = NULL
 4. \<And>cap s s' ko y' v0 tcb sa x. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' (capability.ThreadCap v0) s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); ko_at' ko v0 s; excaps_map extraCaps \<noteq> []; map_to_tcbs (ksPSpace s) v0 = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr v0) = Some y'; cp = capability.ThreadCap v0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ctcb_relation tcb y'; tcbBoundNotification tcb \<noteq> Some 0; (sa, s') \<in> rf_sr; tcbBoundNotification tcb = Some x; h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) = NULL\<rbrakk> \<Longrightarrow> False
 5. \<And>cap s s' ko y' v0. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' (capability.ThreadCap v0) s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); ko_at' ko v0 s; excaps_map extraCaps \<noteq> []; map_to_tcbs (ksPSpace s) v0 = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr v0) = Some y'; cp = capability.ThreadCap v0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))
 6. \<And>cap s s' ko y' v0. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' (capability.ThreadCap v0) s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); ko_at' ko v0 s; excaps_map extraCaps \<noteq> []; map_to_tcbs (ksPSpace s) v0 = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr v0) = Some y'; cp = capability.ThreadCap v0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrakk> \<Longrightarrow> s' \<in> (if cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {}) proof (prove)
goal (5 subgoals):
 1. \<And>cap s s' ko y' v0 tcb sa v0a v1 v2 v3. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' (capability.ThreadCap v0) s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); ko_at' ko v0 s; excaps_map extraCaps \<noteq> []; map_to_tcbs (ksPSpace s) v0 = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr v0) = Some y'; cp = capability.ThreadCap v0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ctcb_relation tcb y'; tcbBoundNotification tcb \<noteq> Some 0; (sa, s') \<in> rf_sr; tcbBoundNotification tcb = None; ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))); fst (extraCaps ! 0) = capability.NotificationCap v0a v1 v2 v3\<rbrakk> \<Longrightarrow> s'\<lparr>tcb_' := tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)), ntfn_cap_' := h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])), ret__unsigned_' := cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])))\<rparr> \<in> (if cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})
 2. \<And>cap s s' ko y' v0 tcb sa. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' (capability.ThreadCap v0) s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); ko_at' ko v0 s; excaps_map extraCaps \<noteq> []; map_to_tcbs (ksPSpace s) v0 = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr v0) = Some y'; cp = capability.ThreadCap v0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ctcb_relation tcb y'; tcbBoundNotification tcb \<noteq> Some 0; (sa, s') \<in> rf_sr; tcbBoundNotification tcb = None\<rbrakk> \<Longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) = NULL
 3. \<And>cap s s' ko y' v0 tcb sa x. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' (capability.ThreadCap v0) s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); ko_at' ko v0 s; excaps_map extraCaps \<noteq> []; map_to_tcbs (ksPSpace s) v0 = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr v0) = Some y'; cp = capability.ThreadCap v0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ctcb_relation tcb y'; tcbBoundNotification tcb \<noteq> Some 0; (sa, s') \<in> rf_sr; tcbBoundNotification tcb = Some x; h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) = NULL\<rbrakk> \<Longrightarrow> False
 4. \<And>cap s s' ko y' v0. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' (capability.ThreadCap v0) s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); ko_at' ko v0 s; excaps_map extraCaps \<noteq> []; map_to_tcbs (ksPSpace s) v0 = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr v0) = Some y'; cp = capability.ThreadCap v0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))
 5. \<And>cap s s' ko y' v0. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' (capability.ThreadCap v0) s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); ko_at' ko v0 s; excaps_map extraCaps \<noteq> []; map_to_tcbs (ksPSpace s) v0 = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr v0) = Some y'; cp = capability.ThreadCap v0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrakk> \<Longrightarrow> s' \<in> (if cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {}) proof (prove)
goal (5 subgoals):
 1. \<And>cap s s' ko y' v0 tcb sa v0a v1 v2 v3. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' (capability.ThreadCap v0) s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); ko_at' ko v0 s; excaps_map extraCaps \<noteq> []; map_to_tcbs (ksPSpace s) v0 = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr v0) = Some y'; cp = capability.ThreadCap v0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ctcb_relation tcb y'; (sa, s') \<in> rf_sr; tcbBoundNotification tcb = None; ccap_relation (capability.NotificationCap v0a v1 v2 v3) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))); fst (extraCaps ! 0) = capability.NotificationCap v0a v1 v2 v3\<rbrakk> \<Longrightarrow> s'\<lparr>tcb_' := tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)), ntfn_cap_' := h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])), ret__unsigned_' := cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])))\<rparr> \<in> (if cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})
 2. \<And>cap s s' ko y' v0 tcb sa. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' (capability.ThreadCap v0) s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); ko_at' ko v0 s; excaps_map extraCaps \<noteq> []; map_to_tcbs (ksPSpace s) v0 = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr v0) = Some y'; cp = capability.ThreadCap v0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ctcb_relation tcb y'; tcbBoundNotification tcb \<noteq> Some 0; (sa, s') \<in> rf_sr; tcbBoundNotification tcb = None\<rbrakk> \<Longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) = NULL
 3. \<And>cap s s' ko y' v0 tcb sa x. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' (capability.ThreadCap v0) s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); ko_at' ko v0 s; excaps_map extraCaps \<noteq> []; map_to_tcbs (ksPSpace s) v0 = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr v0) = Some y'; cp = capability.ThreadCap v0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ctcb_relation tcb y'; tcbBoundNotification tcb \<noteq> Some 0; (sa, s') \<in> rf_sr; tcbBoundNotification tcb = Some x; h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) = NULL\<rbrakk> \<Longrightarrow> False
 4. \<And>cap s s' ko y' v0. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' (capability.ThreadCap v0) s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); ko_at' ko v0 s; excaps_map extraCaps \<noteq> []; map_to_tcbs (ksPSpace s) v0 = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr v0) = Some y'; cp = capability.ThreadCap v0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))
 5. \<And>cap s s' ko y' v0. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' (capability.ThreadCap v0) s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); ko_at' ko v0 s; excaps_map extraCaps \<noteq> []; map_to_tcbs (ksPSpace s) v0 = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr v0) = Some y'; cp = capability.ThreadCap v0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrakk> \<Longrightarrow> s' \<in> (if cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {}) proof (prove)
goal (5 subgoals):
 1. \<And>cap s s' ko y' v0 tcb sa v0a v1 v2 v3. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' (capability.ThreadCap v0) s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); ko_at' ko v0 s; excaps_map extraCaps \<noteq> []; map_to_tcbs (ksPSpace s) v0 = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr v0) = Some y'; cp = capability.ThreadCap v0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ctcb_relation tcb y'; (sa, s') \<in> rf_sr; tcbBoundNotification tcb = None; ccap_relation (capability.NotificationCap v0a v1 v2 v3) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))); fst (extraCaps ! 0) = capability.NotificationCap v0a v1 v2 v3; cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrakk> \<Longrightarrow> s'\<lparr>tcb_' := tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)), ntfn_cap_' := h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])), ret__unsigned_' := cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])))\<rparr> \<in> (if cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})
 2. \<And>cap s s' ko y' v0 tcb sa. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' (capability.ThreadCap v0) s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); ko_at' ko v0 s; excaps_map extraCaps \<noteq> []; map_to_tcbs (ksPSpace s) v0 = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr v0) = Some y'; cp = capability.ThreadCap v0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ctcb_relation tcb y'; tcbBoundNotification tcb \<noteq> Some 0; (sa, s') \<in> rf_sr; tcbBoundNotification tcb = None\<rbrakk> \<Longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) = NULL
 3. \<And>cap s s' ko y' v0 tcb sa x. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' (capability.ThreadCap v0) s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); ko_at' ko v0 s; excaps_map extraCaps \<noteq> []; map_to_tcbs (ksPSpace s) v0 = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr v0) = Some y'; cp = capability.ThreadCap v0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ctcb_relation tcb y'; tcbBoundNotification tcb \<noteq> Some 0; (sa, s') \<in> rf_sr; tcbBoundNotification tcb = Some x; h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) = NULL\<rbrakk> \<Longrightarrow> False
 4. \<And>cap s s' ko y' v0. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' (capability.ThreadCap v0) s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); ko_at' ko v0 s; excaps_map extraCaps \<noteq> []; map_to_tcbs (ksPSpace s) v0 = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr v0) = Some y'; cp = capability.ThreadCap v0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))
 5. \<And>cap s s' ko y' v0. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' (capability.ThreadCap v0) s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); ko_at' ko v0 s; excaps_map extraCaps \<noteq> []; map_to_tcbs (ksPSpace s) v0 = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr v0) = Some y'; cp = capability.ThreadCap v0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrakk> \<Longrightarrow> s' \<in> (if cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {}) proof (prove)
goal (4 subgoals):
 1. \<And>cap s s' ko y' v0 tcb sa. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' (capability.ThreadCap v0) s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); ko_at' ko v0 s; excaps_map extraCaps \<noteq> []; map_to_tcbs (ksPSpace s) v0 = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr v0) = Some y'; cp = capability.ThreadCap v0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ctcb_relation tcb y'; tcbBoundNotification tcb \<noteq> Some 0; (sa, s') \<in> rf_sr; tcbBoundNotification tcb = None\<rbrakk> \<Longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) = NULL
 2. \<And>cap s s' ko y' v0 tcb sa x. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' (capability.ThreadCap v0) s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); ko_at' ko v0 s; excaps_map extraCaps \<noteq> []; map_to_tcbs (ksPSpace s) v0 = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr v0) = Some y'; cp = capability.ThreadCap v0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ctcb_relation tcb y'; tcbBoundNotification tcb \<noteq> Some 0; (sa, s') \<in> rf_sr; tcbBoundNotification tcb = Some x; h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(notification_C ptr) &(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))\<rightarrow>[''tcbBoundNotification_C''])) = NULL\<rbrakk> \<Longrightarrow> False
 3. \<And>cap s s' ko y' v0. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' (capability.ThreadCap v0) s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); ko_at' ko v0 s; excaps_map extraCaps \<noteq> []; map_to_tcbs (ksPSpace s) v0 = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr v0) = Some y'; cp = capability.ThreadCap v0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))
 4. \<And>cap s s' ko y' v0. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' (capability.ThreadCap v0) s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; excaps_in_mem extraCaps (ctes_of s); ko_at' ko v0 s; excaps_map extraCaps \<noteq> []; map_to_tcbs (ksPSpace s) v0 = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr v0) = Some y'; cp = capability.ThreadCap v0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrakk> \<Longrightarrow> s' \<in> (if cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {}) proof (prove)
goal:
No subgoals!