theory Syscall_R

lemma handleRecv_isBlocking_corres':
   "corres dc (einvs and ct_in_state active
                    and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s))
              (invs' and ct_in_state' simple'
                     and sch_act_sane
                     and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))
                     and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s))
                    (handle_recv isBlocking) (handleRecv isBlocking)"
  (is "corres dc (?pre1) (?pre2) (handle_recv _) (handleRecv _)") apply (simp add: handle_recv_def handleRecv_def liftM_bind Let_def
                   cap_register_def capRegister_def
             cong: if_cong cap.case_cong capability.case_cong bool.case_cong) apply (rule corres_guard_imp) apply (rule corres_split_eqr[OF getCurThread_corres]) apply (rule corres_split_eqr[OF asUser_getRegister_corres]) apply (rule corres_split_catch) apply (rule corres_cap_fault) apply (rule corres_splitEE[OF lookupCap_corres]) apply (rule_tac P="?pre1 and tcb_at thread
                                and (\<lambda>s. (cur_thread s) = thread  )
                                and valid_cap rv"
                        and P'="?pre2 and tcb_at' thread and valid_cap' rv'" in corres_inst) apply (clarsimp split: cap_relation_split_asm arch_cap.split_asm split del: if_split
                              simp: lookup_failure_map_def whenE_def) apply (rule corres_guard_imp) apply (rename_tac rights) apply (case_tac "AllowRead \<in> rights"; simp) apply (rule corres_split_nor[OF deleteCallerCap_corres]) apply (rule receiveIPC_corres) apply (clarsimp)+ apply (wp delete_caller_cap_nonz_cap delete_caller_cap_valid_ep_cap)+ apply (clarsimp)+ apply (clarsimp simp: lookup_failure_map_def)+ apply (clarsimp simp: valid_cap'_def capAligned_def) apply (rule corres_guard_imp) apply (rename_tac rights) apply (case_tac "AllowRead \<in> rights"; simp) apply (rule_tac r'=ntfn_relation in corres_splitEE) apply clarsimp apply (rule getNotification_corres) apply (rule corres_if) apply (clarsimp simp: ntfn_relation_def) apply (clarsimp, rule receiveSignal_corres) prefer 3 apply (rule corres_trivial) apply (clarsimp simp: lookup_failure_map_def)+ apply (wp get_simple_ko_wp getNotification_wp | wpcw | simp)+ apply (clarsimp simp: lookup_failure_map_def) apply (clarsimp simp: valid_cap_def ct_in_state_def) apply (clarsimp simp: valid_cap'_def capAligned_def) apply wp+ apply (rule handleFault_corres) apply simp apply (wp get_simple_ko_wp | wpcw | simp)+ apply (rule hoare_vcg_E_elim) apply (simp add: lookup_cap_def lookup_slot_for_thread_def) apply wp apply (simp add: split_def) apply (wp resolve_address_bits_valid_fault2)+ apply (wp getNotification_wp | wpcw | simp add: valid_fault_def whenE_def split del: if_split)+ apply (clarsimp simp add: ct_in_state_def  ct_in_state'_def conj_comms invs_valid_tcb_ctable
                             invs_valid_objs tcb_at_invs invs_psp_aligned invs_cur) apply (clarsimp simp: invs'_def valid_state'_def valid_pspace'_def
                        ct_in_state'_def sch_act_sane_not) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. corres dc (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s)) (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s)) (handle_recv isBlocking) (handleRecv isBlocking) proof (prove)
goal (1 subgoal):
 1. corres dc (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s)) (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s)) (do thread <- gets cur_thread;
x <- as_user thread (getRegister ARM.capRegister);
cap_fault_on_failure x True (lookup_cap thread (to_bl x) >>=E case_cap (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word bool set. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word nat list. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word option nat. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>arch_cap. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0))) <catch> handle_fault thread
od) (do thread <- getCurThread;
epCPtr <- asUser thread (getRegister ARM.capRegister);
capFaultOnFailure epCPtr True (lookupCap thread epCPtr >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))) <catch> handleFault thread
od) proof (prove)
goal (3 subgoals):
 1. corres dc ?Q18 ?Q'18 (do thread <- gets cur_thread;
x <- as_user thread (getRegister ARM.capRegister);
cap_fault_on_failure x True (lookup_cap thread (to_bl x) >>=E case_cap (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word bool set. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word nat list. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word option nat. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>arch_cap. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0))) <catch> handle_fault thread
od) (do thread <- getCurThread;
epCPtr <- asUser thread (getRegister ARM.capRegister);
capFaultOnFailure epCPtr True (lookupCap thread epCPtr >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))) <catch> handleFault thread
od)
 2. \<And>s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s)) s \<Longrightarrow> ?Q18 s
 3. \<And>s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s)) s \<Longrightarrow> ?Q'18 s proof (prove)
goal (5 subgoals):
 1. \<And>thread. corres dc (?R22 thread) (?R'22 thread) (do x <- as_user thread (getRegister ARM.capRegister);
cap_fault_on_failure x True (lookup_cap thread (to_bl x) >>=E case_cap (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word bool set. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word nat list. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word option nat. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>arch_cap. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0))) <catch> handle_fault thread
od) (do epCPtr <- asUser thread (getRegister ARM.capRegister);
capFaultOnFailure epCPtr True (lookupCap thread epCPtr >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))) <catch> handleFault thread
od)
 2. \<lbrace>?Q22\<rbrace> gets cur_thread \<lbrace>?R22\<rbrace>
 3. \<lbrace>?Q'22\<rbrace> getCurThread \<lbrace>?R'22\<rbrace>
 4. \<And>s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s)) s \<Longrightarrow> ((\<lambda>_. True) and ?Q22) s
 5. \<And>s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s)) s \<Longrightarrow> ((\<lambda>_. True) and ?Q'22) s proof (prove)
goal (7 subgoals):
 1. \<And>thread x. corres dc (?R26 thread x) (?R'26 thread x) (cap_fault_on_failure x True (lookup_cap thread (to_bl x) >>=E case_cap (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word bool set. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word nat list. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word option nat. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>arch_cap. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0))) <catch> handle_fault thread) (capFaultOnFailure x True (lookupCap thread x >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))) <catch> handleFault thread)
 2. \<And>thread. \<lbrace>?Q26 thread\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>?R26 thread\<rbrace>
 3. \<And>thread. \<lbrace>?Q'26 thread\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>?R'26 thread\<rbrace>
 4. \<lbrace>?Q22\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. tcb_at thread and ?Q26 thread\<rbrace>
 5. \<lbrace>?Q'22\<rbrace> getCurThread \<lbrace>\<lambda>thread. tcb_at' thread and ?Q'26 thread\<rbrace>
 6. \<And>s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s)) s \<Longrightarrow> ((\<lambda>_. True) and ?Q22) s
 7. \<And>s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s)) s \<Longrightarrow> ((\<lambda>_. True) and ?Q'22) s proof (prove)
goal (10 subgoals):
 1. \<And>thread x. corres (?f31 thread x \<oplus> dc) (?P31 thread x) (?P'31 thread x) (cap_fault_on_failure x True (lookup_cap thread (to_bl x) >>=E case_cap (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word bool set. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word nat list. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word option nat. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>arch_cap. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)))) (capFaultOnFailure x True (lookupCap thread x >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))))
 2. \<And>thread x ft ft'. ?f31 thread x ft ft' \<Longrightarrow> corres dc (?E31 thread x ft) (?E'31 thread x ft') (handle_fault thread ft) (handleFault thread ft')
 3. \<And>thread x. \<lbrace>?Q31 thread x\<rbrace> cap_fault_on_failure x True (lookup_cap thread (to_bl x) >>=E case_cap (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word bool set. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word nat list. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word option nat. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>arch_cap. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E31 thread x\<rbrace>
 4. \<And>thread x. \<lbrace>?Q'31 thread x\<rbrace> capFaultOnFailure x True (lookupCap thread x >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E'31 thread x\<rbrace>
 5. \<And>thread. \<lbrace>?Q26 thread\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. ?P31 thread x and ?Q31 thread x\<rbrace>
 6. \<And>thread. \<lbrace>?Q'26 thread\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. ?P'31 thread x and ?Q'31 thread x\<rbrace>
 7. \<lbrace>?Q22\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. tcb_at thread and ?Q26 thread\<rbrace>
 8. \<lbrace>?Q'22\<rbrace> getCurThread \<lbrace>\<lambda>thread. tcb_at' thread and ?Q'26 thread\<rbrace>
 9. \<And>s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s)) s \<Longrightarrow> ((\<lambda>_. True) and ?Q22) s
 10. \<And>s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s)) s \<Longrightarrow> ((\<lambda>_. True) and ?Q'22) s proof (prove)
goal (10 subgoals):
 1. \<And>thread x. corres (lfr \<oplus> dc) (?P31 thread x) (?P'31 thread x) (lookup_cap thread (to_bl x) >>=E case_cap (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word bool set. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word nat list. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word option nat. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>arch_cap. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0))) (lookupCap thread x >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)))
 2. \<And>thread x ft ft'. fr ft ft' \<Longrightarrow> corres dc (?E31 thread x ft) (?E'31 thread x ft') (handle_fault thread ft) (handleFault thread ft')
 3. \<And>thread x. \<lbrace>?Q31 thread x\<rbrace> cap_fault_on_failure x True (lookup_cap thread (to_bl x) >>=E case_cap (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word bool set. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word nat list. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word option nat. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>arch_cap. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E31 thread x\<rbrace>
 4. \<And>thread x. \<lbrace>?Q'31 thread x\<rbrace> capFaultOnFailure x True (lookupCap thread x >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E'31 thread x\<rbrace>
 5. \<And>thread. \<lbrace>?Q26 thread\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. ?P31 thread x and ?Q31 thread x\<rbrace>
 6. \<And>thread. \<lbrace>?Q'26 thread\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. ?P'31 thread x and ?Q'31 thread x\<rbrace>
 7. \<lbrace>?Q22\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. tcb_at thread and ?Q26 thread\<rbrace>
 8. \<lbrace>?Q'22\<rbrace> getCurThread \<lbrace>\<lambda>thread. tcb_at' thread and ?Q'26 thread\<rbrace>
 9. \<And>s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s)) s \<Longrightarrow> ((\<lambda>_. True) and ?Q22) s
 10. \<And>s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s)) s \<Longrightarrow> ((\<lambda>_. True) and ?Q'22) s proof (prove)
goal (12 subgoals):
 1. \<And>thread x rv rv'. cap_relation rv rv' \<Longrightarrow> corres (lfr \<oplus> dc) (?R38 thread x rv) (?R'38 thread x rv') (case rv of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0) | _ \<Rightarrow> throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (case rv' of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0) | capability.EndpointCap x xa xb True xc xd \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0) | _ \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0))
 2. \<And>thread x. \<lbrace>?Q38 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>?R38 thread x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>thread x. \<lbrace>?Q'38 thread x\<rbrace> lookupCap thread x \<lbrace>?R'38 thread x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>thread x ft ft'. fr ft ft' \<Longrightarrow> corres dc (?E31 thread x ft) (?E'31 thread x ft') (handle_fault thread ft) (handleFault thread ft')
 5. \<And>thread x. \<lbrace>?Q31 thread x\<rbrace> cap_fault_on_failure x True (lookup_cap thread (to_bl x) >>=E case_cap (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word bool set. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word nat list. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word option nat. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>arch_cap. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E31 thread x\<rbrace>
 6. \<And>thread x. \<lbrace>?Q'31 thread x\<rbrace> capFaultOnFailure x True (lookupCap thread x >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E'31 thread x\<rbrace>
 7. \<And>thread. \<lbrace>?Q26 thread\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs and pspace_aligned and tcb_at thread and ?Q38 thread x and ?Q31 thread x\<rbrace>
 8. \<And>thread. \<lbrace>?Q'26 thread\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs' and pspace_aligned' and pspace_distinct' and tcb_at' thread and ?Q'38 thread x and ?Q'31 thread x\<rbrace>
 9. \<lbrace>?Q22\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. tcb_at thread and ?Q26 thread\<rbrace>
 10. \<lbrace>?Q'22\<rbrace> getCurThread \<lbrace>\<lambda>thread. tcb_at' thread and ?Q'26 thread\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>thread x rv rv'. cap_relation rv rv' \<Longrightarrow> corres (lfr \<oplus> dc) (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap rv) (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' rv') (case rv of cap.EndpointCap ref badge rights \<Rightarrow> if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0) | cap.NotificationCap ref badge rights \<Rightarrow> if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0) | _ \<Rightarrow> throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (case rv' of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0) | capability.EndpointCap x xa xb True xc xd \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0) | _ \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0))
 2. \<And>thread x. \<lbrace>?Q38 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>rv. einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>thread x. \<lbrace>?Q'38 thread x\<rbrace> lookupCap thread x \<lbrace>\<lambda>rv'. invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>thread x ft ft'. fr ft ft' \<Longrightarrow> corres dc (?E31 thread x ft) (?E'31 thread x ft') (handle_fault thread ft) (handleFault thread ft')
 5. \<And>thread x. \<lbrace>?Q31 thread x\<rbrace> cap_fault_on_failure x True (lookup_cap thread (to_bl x) >>=E case_cap (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word bool set. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word nat list. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word option nat. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>arch_cap. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E31 thread x\<rbrace>
 6. \<And>thread x. \<lbrace>?Q'31 thread x\<rbrace> capFaultOnFailure x True (lookupCap thread x >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E'31 thread x\<rbrace>
 7. \<And>thread. \<lbrace>?Q26 thread\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs and pspace_aligned and tcb_at thread and ?Q38 thread x and ?Q31 thread x\<rbrace>
 8. \<And>thread. \<lbrace>?Q'26 thread\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs' and pspace_aligned' and pspace_distinct' and tcb_at' thread and ?Q'38 thread x and ?Q'31 thread x\<rbrace>
 9. \<lbrace>?Q22\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. tcb_at thread and ?Q26 thread\<rbrace>
 10. \<lbrace>?Q'22\<rbrace> getCurThread \<lbrace>\<lambda>thread. tcb_at' thread and ?Q'26 thread\<rbrace>
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>thread x31 x32 x33. corres (lfr \<oplus> dc) (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.EndpointCap x31 x32 x33)) (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.EndpointCap x31 x32 (AllowWrite \<in> x33) (AllowRead \<in> x33) (AllowGrant \<in> x33) (AllowGrantReply \<in> x33))) (if AllowRead \<in> x33 then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap x31 x32 x33) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (case AllowRead \<in> x33 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x31 x32 (AllowWrite \<in> x33) True (AllowGrant \<in> x33) (AllowGrantReply \<in> x33)) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0))
 2. \<And>thread x41 x42 x43. corres (lfr \<oplus> dc) (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.NotificationCap x41 x42 x43)) (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) (AllowRead \<in> x43))) (if AllowRead \<in> x43 then doE ntfn <- liftE (get_notification x41);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap x41 x42 x43) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (case AllowRead \<in> x43 of True \<Rightarrow> doE ntfn <- liftE (getNotification x41);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0))
 3. \<And>thread x. \<lbrace>?Q38 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>rv. einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>thread x. \<lbrace>?Q'38 thread x\<rbrace> lookupCap thread x \<lbrace>\<lambda>rv'. invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>thread x ft ft'. fr ft ft' \<Longrightarrow> corres dc (?E31 thread x ft) (?E'31 thread x ft') (handle_fault thread ft) (handleFault thread ft')
 6. \<And>thread x. \<lbrace>?Q31 thread x\<rbrace> cap_fault_on_failure x True (lookup_cap thread (to_bl x) >>=E case_cap (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word bool set. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word nat list. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word option nat. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>arch_cap. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E31 thread x\<rbrace>
 7. \<And>thread x. \<lbrace>?Q'31 thread x\<rbrace> capFaultOnFailure x True (lookupCap thread x >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E'31 thread x\<rbrace>
 8. \<And>thread. \<lbrace>?Q26 thread\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs and pspace_aligned and tcb_at thread and ?Q38 thread x and ?Q31 thread x\<rbrace>
 9. \<And>thread. \<lbrace>?Q'26 thread\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs' and pspace_aligned' and pspace_distinct' and tcb_at' thread and ?Q'38 thread x and ?Q'31 thread x\<rbrace>
 10. \<lbrace>?Q22\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. tcb_at thread and ?Q26 thread\<rbrace>
A total of 13 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>thread x31 x32 x33. corres (lfr \<oplus> dc) (?Q146 thread x31 x32 x33) (?Q'146 thread x31 x32 x33) (if AllowRead \<in> x33 then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap x31 x32 x33) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (case AllowRead \<in> x33 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x31 x32 (AllowWrite \<in> x33) True (AllowGrant \<in> x33) (AllowGrantReply \<in> x33)) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0))
 2. \<And>thread x31 x32 x33 s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.EndpointCap x31 x32 x33)) s \<Longrightarrow> ?Q146 thread x31 x32 x33 s
 3. \<And>thread x31 x32 x33 s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.EndpointCap x31 x32 (AllowWrite \<in> x33) (AllowRead \<in> x33) (AllowGrant \<in> x33) (AllowGrantReply \<in> x33))) s \<Longrightarrow> ?Q'146 thread x31 x32 x33 s
 4. \<And>thread x41 x42 x43. corres (lfr \<oplus> dc) (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.NotificationCap x41 x42 x43)) (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) (AllowRead \<in> x43))) (if AllowRead \<in> x43 then doE ntfn <- liftE (get_notification x41);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap x41 x42 x43) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (case AllowRead \<in> x43 of True \<Rightarrow> doE ntfn <- liftE (getNotification x41);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0))
 5. \<And>thread x. \<lbrace>?Q38 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>rv. einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>thread x. \<lbrace>?Q'38 thread x\<rbrace> lookupCap thread x \<lbrace>\<lambda>rv'. invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>thread x ft ft'. fr ft ft' \<Longrightarrow> corres dc (?E31 thread x ft) (?E'31 thread x ft') (handle_fault thread ft) (handleFault thread ft')
 8. \<And>thread x. \<lbrace>?Q31 thread x\<rbrace> cap_fault_on_failure x True (lookup_cap thread (to_bl x) >>=E case_cap (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word bool set. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word nat list. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word option nat. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>arch_cap. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E31 thread x\<rbrace>
 9. \<And>thread x. \<lbrace>?Q'31 thread x\<rbrace> capFaultOnFailure x True (lookupCap thread x >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E'31 thread x\<rbrace>
 10. \<And>thread. \<lbrace>?Q26 thread\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs and pspace_aligned and tcb_at thread and ?Q38 thread x and ?Q31 thread x\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>thread x31 x32 rights. corres (lfr \<oplus> dc) (?Q146 thread x31 x32 rights) (?Q'146 thread x31 x32 rights) (if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap x31 x32 rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (case AllowRead \<in> rights of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x31 x32 (AllowWrite \<in> rights) True (AllowGrant \<in> rights) (AllowGrantReply \<in> rights)) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0))
 2. \<And>thread x31 x32 x33 s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.EndpointCap x31 x32 x33)) s \<Longrightarrow> ?Q146 thread x31 x32 x33 s
 3. \<And>thread x31 x32 x33 s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.EndpointCap x31 x32 (AllowWrite \<in> x33) (AllowRead \<in> x33) (AllowGrant \<in> x33) (AllowGrantReply \<in> x33))) s \<Longrightarrow> ?Q'146 thread x31 x32 x33 s
 4. \<And>thread x41 x42 x43. corres (lfr \<oplus> dc) (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.NotificationCap x41 x42 x43)) (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) (AllowRead \<in> x43))) (if AllowRead \<in> x43 then doE ntfn <- liftE (get_notification x41);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap x41 x42 x43) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (case AllowRead \<in> x43 of True \<Rightarrow> doE ntfn <- liftE (getNotification x41);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0))
 5. \<And>thread x. \<lbrace>?Q38 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>rv. einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>thread x. \<lbrace>?Q'38 thread x\<rbrace> lookupCap thread x \<lbrace>\<lambda>rv'. invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>thread x ft ft'. fr ft ft' \<Longrightarrow> corres dc (?E31 thread x ft) (?E'31 thread x ft') (handle_fault thread ft) (handleFault thread ft')
 8. \<And>thread x. \<lbrace>?Q31 thread x\<rbrace> cap_fault_on_failure x True (lookup_cap thread (to_bl x) >>=E case_cap (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word bool set. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word nat list. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word option nat. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>arch_cap. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E31 thread x\<rbrace>
 9. \<And>thread x. \<lbrace>?Q'31 thread x\<rbrace> capFaultOnFailure x True (lookupCap thread x >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E'31 thread x\<rbrace>
 10. \<And>thread. \<lbrace>?Q26 thread\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs and pspace_aligned and tcb_at thread and ?Q38 thread x and ?Q31 thread x\<rbrace>
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>thread x31 x32 rights. AllowRead \<in> rights \<Longrightarrow> corres dc (?Q146 thread x31 x32 rights) (?Q'146 thread x31 x32 rights) (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap x31 x32 rights) isBlocking
od) (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x31 x32 (AllowWrite \<in> rights) True (AllowGrant \<in> rights) (AllowGrantReply \<in> rights)) isBlocking
od)
 2. \<And>thread x31 x32 rights. AllowRead \<notin> rights \<Longrightarrow> (\<exists>s. ?Q146 thread x31 x32 rights s \<and> (\<exists>s'. ?Q'146 thread x31 x32 rights s' \<and> (s, s') \<in> state_relation)) \<longrightarrow> Fault_H.lookup_failure.MissingCapability 0 = lookup_failure_map (ExceptionTypes_A.lookup_failure.MissingCapability 0)
 3. \<And>thread x31 x32 x33 s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.EndpointCap x31 x32 x33)) s \<Longrightarrow> ?Q146 thread x31 x32 x33 s
 4. \<And>thread x31 x32 x33 s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.EndpointCap x31 x32 (AllowWrite \<in> x33) (AllowRead \<in> x33) (AllowGrant \<in> x33) (AllowGrantReply \<in> x33))) s \<Longrightarrow> ?Q'146 thread x31 x32 x33 s
 5. \<And>thread x41 x42 x43. corres (lfr \<oplus> dc) (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.NotificationCap x41 x42 x43)) (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) (AllowRead \<in> x43))) (if AllowRead \<in> x43 then doE ntfn <- liftE (get_notification x41);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap x41 x42 x43) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (case AllowRead \<in> x43 of True \<Rightarrow> doE ntfn <- liftE (getNotification x41);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0))
 6. \<And>thread x. \<lbrace>?Q38 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>rv. einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>thread x. \<lbrace>?Q'38 thread x\<rbrace> lookupCap thread x \<lbrace>\<lambda>rv'. invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>thread x ft ft'. fr ft ft' \<Longrightarrow> corres dc (?E31 thread x ft) (?E'31 thread x ft') (handle_fault thread ft) (handleFault thread ft')
 9. \<And>thread x. \<lbrace>?Q31 thread x\<rbrace> cap_fault_on_failure x True (lookup_cap thread (to_bl x) >>=E case_cap (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word bool set. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word nat list. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word option nat. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>arch_cap. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E31 thread x\<rbrace>
 10. \<And>thread x. \<lbrace>?Q'31 thread x\<rbrace> capFaultOnFailure x True (lookupCap thread x >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E'31 thread x\<rbrace>
A total of 16 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread x31 x32 rights. AllowRead \<in> rights \<Longrightarrow> corres dc (?R157 thread x31 x32 rights) (?R'157 thread x31 x32 rights) (receive_ipc thread (cap.EndpointCap x31 x32 rights) isBlocking) (receiveIPC thread (capability.EndpointCap x31 x32 (AllowWrite \<in> rights) True (AllowGrant \<in> rights) (AllowGrantReply \<in> rights)) isBlocking)
 2. \<And>thread x31 x32 rights. AllowRead \<in> rights \<Longrightarrow> \<lbrace>?Q157 thread x31 x32 rights\<rbrace> delete_caller_cap thread \<lbrace>\<lambda>x. ?R157 thread x31 x32 rights\<rbrace>
 3. \<And>thread x31 x32 rights. AllowRead \<in> rights \<Longrightarrow> \<lbrace>?Q'157 thread x31 x32 rights\<rbrace> deleteCallerCap thread \<lbrace>\<lambda>x. ?R'157 thread x31 x32 rights\<rbrace>
 4. \<And>thread x31 x32 rights. AllowRead \<notin> rights \<Longrightarrow> (\<exists>s. (einvs and tcb_at thread and ?Q157 thread x31 x32 rights) s \<and> (\<exists>s'. (invs' and tcb_at' thread and ?Q'157 thread x31 x32 rights) s' \<and> (s, s') \<in> state_relation)) \<longrightarrow> Fault_H.lookup_failure.MissingCapability 0 = lookup_failure_map (ExceptionTypes_A.lookup_failure.MissingCapability 0)
 5. \<And>thread x31 x32 x33 s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.EndpointCap x31 x32 x33)) s \<Longrightarrow> (einvs and tcb_at thread and ?Q157 thread x31 x32 x33) s
 6. \<And>thread x31 x32 x33 s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.EndpointCap x31 x32 (AllowWrite \<in> x33) (AllowRead \<in> x33) (AllowGrant \<in> x33) (AllowGrantReply \<in> x33))) s \<Longrightarrow> (invs' and tcb_at' thread and ?Q'157 thread x31 x32 x33) s
 7. \<And>thread x41 x42 x43. corres (lfr \<oplus> dc) (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.NotificationCap x41 x42 x43)) (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) (AllowRead \<in> x43))) (if AllowRead \<in> x43 then doE ntfn <- liftE (get_notification x41);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap x41 x42 x43) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (case AllowRead \<in> x43 of True \<Rightarrow> doE ntfn <- liftE (getNotification x41);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0))
 8. \<And>thread x. \<lbrace>?Q38 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>rv. einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>thread x. \<lbrace>?Q'38 thread x\<rbrace> lookupCap thread x \<lbrace>\<lambda>rv'. invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>thread x ft ft'. fr ft ft' \<Longrightarrow> corres dc (?E31 thread x ft) (?E'31 thread x ft') (handle_fault thread ft) (handleFault thread ft')
A total of 18 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread x31 x32 rights. AllowRead \<in> rights \<Longrightarrow> is_ep_cap (cap.EndpointCap x31 x32 rights)
 2. \<And>thread x31 x32 rights. AllowRead \<in> rights \<Longrightarrow> cap_relation (cap.EndpointCap x31 x32 rights) (capability.EndpointCap x31 x32 (AllowWrite \<in> rights) True (AllowGrant \<in> rights) (AllowGrantReply \<in> rights))
 3. \<And>thread x31 x32 rights. AllowRead \<in> rights \<Longrightarrow> \<lbrace>?Q157 thread x31 x32 rights\<rbrace> delete_caller_cap thread \<lbrace>\<lambda>x. einvs and valid_sched and tcb_at thread and valid_cap (cap.EndpointCap x31 x32 rights) and ex_nonz_cap_to thread and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)\<rbrace>
 4. \<And>thread x31 x32 rights. AllowRead \<in> rights \<Longrightarrow> \<lbrace>?Q'157 thread x31 x32 rights\<rbrace> deleteCallerCap thread \<lbrace>\<lambda>x. invs' and tcb_at' thread and valid_cap' (capability.EndpointCap x31 x32 (AllowWrite \<in> rights) True (AllowGrant \<in> rights) (AllowGrantReply \<in> rights))\<rbrace>
 5. \<And>thread x31 x32 rights. AllowRead \<notin> rights \<Longrightarrow> (\<exists>s. (einvs and tcb_at thread and ?Q157 thread x31 x32 rights) s \<and> (\<exists>s'. (invs' and tcb_at' thread and ?Q'157 thread x31 x32 rights) s' \<and> (s, s') \<in> state_relation)) \<longrightarrow> Fault_H.lookup_failure.MissingCapability 0 = lookup_failure_map (ExceptionTypes_A.lookup_failure.MissingCapability 0)
 6. \<And>thread x31 x32 x33 s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.EndpointCap x31 x32 x33)) s \<Longrightarrow> (einvs and tcb_at thread and ?Q157 thread x31 x32 x33) s
 7. \<And>thread x31 x32 x33 s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.EndpointCap x31 x32 (AllowWrite \<in> x33) (AllowRead \<in> x33) (AllowGrant \<in> x33) (AllowGrantReply \<in> x33))) s \<Longrightarrow> (invs' and tcb_at' thread and ?Q'157 thread x31 x32 x33) s
 8. \<And>thread x41 x42 x43. corres (lfr \<oplus> dc) (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.NotificationCap x41 x42 x43)) (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) (AllowRead \<in> x43))) (if AllowRead \<in> x43 then doE ntfn <- liftE (get_notification x41);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap x41 x42 x43) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (case AllowRead \<in> x43 of True \<Rightarrow> doE ntfn <- liftE (getNotification x41);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0))
 9. \<And>thread x. \<lbrace>?Q38 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>rv. einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>thread x. \<lbrace>?Q'38 thread x\<rbrace> lookupCap thread x \<lbrace>\<lambda>rv'. invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 19 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>thread x31 x32 rights. AllowRead \<in> rights \<Longrightarrow> \<lbrace>?Q157 thread x31 x32 rights\<rbrace> delete_caller_cap thread \<lbrace>\<lambda>x. einvs and tcb_at thread and valid_cap (cap.EndpointCap x31 x32 rights) and ex_nonz_cap_to thread and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)\<rbrace>
 2. \<And>thread x31 x32 rights. AllowRead \<in> rights \<Longrightarrow> \<lbrace>?Q'157 thread x31 x32 rights\<rbrace> deleteCallerCap thread \<lbrace>\<lambda>x. invs' and tcb_at' thread and valid_cap' (capability.EndpointCap x31 x32 (AllowWrite \<in> rights) True (AllowGrant \<in> rights) (AllowGrantReply \<in> rights))\<rbrace>
 3. \<And>thread x31 x32 rights. AllowRead \<notin> rights \<Longrightarrow> (\<exists>s. (einvs and tcb_at thread and ?Q157 thread x31 x32 rights) s \<and> (\<exists>s'. (invs' and tcb_at' thread and ?Q'157 thread x31 x32 rights) s' \<and> (s, s') \<in> state_relation)) \<longrightarrow> Fault_H.lookup_failure.MissingCapability 0 = lookup_failure_map (ExceptionTypes_A.lookup_failure.MissingCapability 0)
 4. \<And>thread x31 x32 x33 s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.EndpointCap x31 x32 x33)) s \<Longrightarrow> (einvs and tcb_at thread and ?Q157 thread x31 x32 x33) s
 5. \<And>thread x31 x32 x33 s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.EndpointCap x31 x32 (AllowWrite \<in> x33) (AllowRead \<in> x33) (AllowGrant \<in> x33) (AllowGrantReply \<in> x33))) s \<Longrightarrow> (invs' and tcb_at' thread and ?Q'157 thread x31 x32 x33) s
 6. \<And>thread x41 x42 x43. corres (lfr \<oplus> dc) (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.NotificationCap x41 x42 x43)) (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) (AllowRead \<in> x43))) (if AllowRead \<in> x43 then doE ntfn <- liftE (get_notification x41);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap x41 x42 x43) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (case AllowRead \<in> x43 of True \<Rightarrow> doE ntfn <- liftE (getNotification x41);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0))
 7. \<And>thread x. \<lbrace>?Q38 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>rv. einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>thread x. \<lbrace>?Q'38 thread x\<rbrace> lookupCap thread x \<lbrace>\<lambda>rv'. invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>thread x ft ft'. fr ft ft' \<Longrightarrow> corres dc (?E31 thread x ft) (?E'31 thread x ft') (handle_fault thread ft) (handleFault thread ft')
 10. \<And>thread x. \<lbrace>?Q31 thread x\<rbrace> cap_fault_on_failure x True (lookup_cap thread (to_bl x) >>=E case_cap (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word bool set. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word nat list. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word option nat. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>arch_cap. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E31 thread x\<rbrace>
A total of 17 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>thread x31 x32 rights. AllowRead \<notin> rights \<Longrightarrow> (\<exists>s. (einvs and tcb_at thread and (\<lambda>s. (invs and tcb_at thread) s \<and> valid_list s \<and> valid_sched s \<and> tcb_at thread s \<and> s \<turnstile> cap.EndpointCap x31 x32 rights \<and> (ex_nonz_cap_to thread and tcb_at thread and valid_objs) s \<and> True)) s \<and> (\<exists>s'. (invs' and tcb_at' thread and (\<lambda>s. invs' s \<and> tcb_at' thread s \<and> valid_cap' (capability.EndpointCap x31 x32 (AllowWrite \<in> rights) True (AllowGrant \<in> rights) (AllowGrantReply \<in> rights)) s)) s' \<and> (s, s') \<in> state_relation)) \<longrightarrow> Fault_H.lookup_failure.MissingCapability 0 = lookup_failure_map (ExceptionTypes_A.lookup_failure.MissingCapability 0)
 2. \<And>thread x31 x32 x33 s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.EndpointCap x31 x32 x33)) s \<Longrightarrow> (einvs and tcb_at thread and (\<lambda>s. (invs and tcb_at thread) s \<and> valid_list s \<and> valid_sched s \<and> tcb_at thread s \<and> s \<turnstile> cap.EndpointCap x31 x32 x33 \<and> (ex_nonz_cap_to thread and tcb_at thread and valid_objs) s \<and> True)) s
 3. \<And>thread x31 x32 x33 s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.EndpointCap x31 x32 (AllowWrite \<in> x33) (AllowRead \<in> x33) (AllowGrant \<in> x33) (AllowGrantReply \<in> x33))) s \<Longrightarrow> (invs' and tcb_at' thread and (\<lambda>s. invs' s \<and> tcb_at' thread s \<and> valid_cap' (capability.EndpointCap x31 x32 (AllowWrite \<in> x33) True (AllowGrant \<in> x33) (AllowGrantReply \<in> x33)) s)) s
 4. \<And>thread x41 x42 x43. corres (lfr \<oplus> dc) (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.NotificationCap x41 x42 x43)) (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) (AllowRead \<in> x43))) (if AllowRead \<in> x43 then doE ntfn <- liftE (get_notification x41);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap x41 x42 x43) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (case AllowRead \<in> x43 of True \<Rightarrow> doE ntfn <- liftE (getNotification x41);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0))
 5. \<And>thread x. \<lbrace>?Q38 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>rv. einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>thread x. \<lbrace>?Q'38 thread x\<rbrace> lookupCap thread x \<lbrace>\<lambda>rv'. invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>thread x ft ft'. fr ft ft' \<Longrightarrow> corres dc (?E31 thread x ft) (?E'31 thread x ft') (handle_fault thread ft) (handleFault thread ft')
 8. \<And>thread x. \<lbrace>?Q31 thread x\<rbrace> cap_fault_on_failure x True (lookup_cap thread (to_bl x) >>=E case_cap (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word bool set. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word nat list. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word option nat. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>arch_cap. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E31 thread x\<rbrace>
 9. \<And>thread x. \<lbrace>?Q'31 thread x\<rbrace> capFaultOnFailure x True (lookupCap thread x >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E'31 thread x\<rbrace>
 10. \<And>thread. \<lbrace>?Q26 thread\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs and pspace_aligned and tcb_at thread and ?Q38 thread x and ?Q31 thread x\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>thread x31 x32 rights s s'. \<lbrakk>AllowRead \<notin> rights; invs s; valid_list s; valid_sched s; s \<turnstile> cap.EndpointCap x31 x32 rights; ex_nonz_cap_to thread s; tcb_at thread s; valid_objs s; invs' s'; tcb_at' thread s'; valid_cap' (capability.EndpointCap x31 x32 (AllowWrite \<in> rights) True (AllowGrant \<in> rights) (AllowGrantReply \<in> rights)) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> Fault_H.lookup_failure.MissingCapability 0 = lookup_failure_map (ExceptionTypes_A.lookup_failure.MissingCapability 0)
 2. \<And>thread x31 x32 x33 s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.EndpointCap x31 x32 x33)) s \<Longrightarrow> (einvs and tcb_at thread and (\<lambda>s. (invs and tcb_at thread) s \<and> valid_list s \<and> valid_sched s \<and> tcb_at thread s \<and> s \<turnstile> cap.EndpointCap x31 x32 x33 \<and> (ex_nonz_cap_to thread and tcb_at thread and valid_objs) s \<and> True)) s
 3. \<And>thread x31 x32 x33 s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.EndpointCap x31 x32 (AllowWrite \<in> x33) (AllowRead \<in> x33) (AllowGrant \<in> x33) (AllowGrantReply \<in> x33))) s \<Longrightarrow> (invs' and tcb_at' thread and (\<lambda>s. invs' s \<and> tcb_at' thread s \<and> valid_cap' (capability.EndpointCap x31 x32 (AllowWrite \<in> x33) True (AllowGrant \<in> x33) (AllowGrantReply \<in> x33)) s)) s
 4. \<And>thread x41 x42 x43. corres (lfr \<oplus> dc) (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.NotificationCap x41 x42 x43)) (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) (AllowRead \<in> x43))) (if AllowRead \<in> x43 then doE ntfn <- liftE (get_notification x41);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap x41 x42 x43) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (case AllowRead \<in> x43 of True \<Rightarrow> doE ntfn <- liftE (getNotification x41);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0))
 5. \<And>thread x. \<lbrace>?Q38 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>rv. einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>thread x. \<lbrace>?Q'38 thread x\<rbrace> lookupCap thread x \<lbrace>\<lambda>rv'. invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>thread x ft ft'. fr ft ft' \<Longrightarrow> corres dc (?E31 thread x ft) (?E'31 thread x ft') (handle_fault thread ft) (handleFault thread ft')
 8. \<And>thread x. \<lbrace>?Q31 thread x\<rbrace> cap_fault_on_failure x True (lookup_cap thread (to_bl x) >>=E case_cap (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word bool set. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word nat list. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word option nat. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>arch_cap. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E31 thread x\<rbrace>
 9. \<And>thread x. \<lbrace>?Q'31 thread x\<rbrace> capFaultOnFailure x True (lookupCap thread x >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E'31 thread x\<rbrace>
 10. \<And>thread. \<lbrace>?Q26 thread\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs and pspace_aligned and tcb_at thread and ?Q38 thread x and ?Q31 thread x\<rbrace>
A total of 15 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>thread x31 x32 x33 s. \<lbrakk>invs' s; ct_in_state' simple' s; sch_act_sane s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' (ksCurThread s) s; tcb_at' thread s; valid_cap' (capability.EndpointCap x31 x32 (AllowWrite \<in> x33) (AllowRead \<in> x33) (AllowGrant \<in> x33) (AllowGrantReply \<in> x33)) s\<rbrakk> \<Longrightarrow> valid_cap' (capability.EndpointCap x31 x32 (AllowWrite \<in> x33) True (AllowGrant \<in> x33) (AllowGrantReply \<in> x33)) s
 2. \<And>thread x41 x42 x43. corres (lfr \<oplus> dc) (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.NotificationCap x41 x42 x43)) (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) (AllowRead \<in> x43))) (if AllowRead \<in> x43 then doE ntfn <- liftE (get_notification x41);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap x41 x42 x43) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (case AllowRead \<in> x43 of True \<Rightarrow> doE ntfn <- liftE (getNotification x41);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0))
 3. \<And>thread x. \<lbrace>?Q38 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>rv. einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>thread x. \<lbrace>?Q'38 thread x\<rbrace> lookupCap thread x \<lbrace>\<lambda>rv'. invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>thread x ft ft'. fr ft ft' \<Longrightarrow> corres dc (?E31 thread x ft) (?E'31 thread x ft') (handle_fault thread ft) (handleFault thread ft')
 6. \<And>thread x. \<lbrace>?Q31 thread x\<rbrace> cap_fault_on_failure x True (lookup_cap thread (to_bl x) >>=E case_cap (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word bool set. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word nat list. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word option nat. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>arch_cap. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E31 thread x\<rbrace>
 7. \<And>thread x. \<lbrace>?Q'31 thread x\<rbrace> capFaultOnFailure x True (lookupCap thread x >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E'31 thread x\<rbrace>
 8. \<And>thread. \<lbrace>?Q26 thread\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs and pspace_aligned and tcb_at thread and ?Q38 thread x and ?Q31 thread x\<rbrace>
 9. \<And>thread. \<lbrace>?Q'26 thread\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs' and pspace_aligned' and pspace_distinct' and tcb_at' thread and ?Q'38 thread x and ?Q'31 thread x\<rbrace>
 10. \<lbrace>?Q22\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. tcb_at thread and ?Q26 thread\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>thread x41 x42 x43. corres (lfr \<oplus> dc) (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.NotificationCap x41 x42 x43)) (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) (AllowRead \<in> x43))) (if AllowRead \<in> x43 then doE ntfn <- liftE (get_notification x41);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap x41 x42 x43) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (case AllowRead \<in> x43 of True \<Rightarrow> doE ntfn <- liftE (getNotification x41);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0))
 2. \<And>thread x. \<lbrace>?Q38 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>rv. einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>thread x. \<lbrace>?Q'38 thread x\<rbrace> lookupCap thread x \<lbrace>\<lambda>rv'. invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>thread x ft ft'. fr ft ft' \<Longrightarrow> corres dc (?E31 thread x ft) (?E'31 thread x ft') (handle_fault thread ft) (handleFault thread ft')
 5. \<And>thread x. \<lbrace>?Q31 thread x\<rbrace> cap_fault_on_failure x True (lookup_cap thread (to_bl x) >>=E case_cap (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word bool set. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word nat list. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word option nat. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>arch_cap. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E31 thread x\<rbrace>
 6. \<And>thread x. \<lbrace>?Q'31 thread x\<rbrace> capFaultOnFailure x True (lookupCap thread x >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E'31 thread x\<rbrace>
 7. \<And>thread. \<lbrace>?Q26 thread\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs and pspace_aligned and tcb_at thread and ?Q38 thread x and ?Q31 thread x\<rbrace>
 8. \<And>thread. \<lbrace>?Q'26 thread\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs' and pspace_aligned' and pspace_distinct' and tcb_at' thread and ?Q'38 thread x and ?Q'31 thread x\<rbrace>
 9. \<lbrace>?Q22\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. tcb_at thread and ?Q26 thread\<rbrace>
 10. \<lbrace>?Q'22\<rbrace> getCurThread \<lbrace>\<lambda>thread. tcb_at' thread and ?Q'26 thread\<rbrace>
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>thread x41 x42 x43. corres (lfr \<oplus> dc) (?Q232 thread x41 x42 x43) (?Q'232 thread x41 x42 x43) (if AllowRead \<in> x43 then doE ntfn <- liftE (get_notification x41);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap x41 x42 x43) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (case AllowRead \<in> x43 of True \<Rightarrow> doE ntfn <- liftE (getNotification x41);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0))
 2. \<And>thread x41 x42 x43 s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.NotificationCap x41 x42 x43)) s \<Longrightarrow> ?Q232 thread x41 x42 x43 s
 3. \<And>thread x41 x42 x43 s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) (AllowRead \<in> x43))) s \<Longrightarrow> ?Q'232 thread x41 x42 x43 s
 4. \<And>thread x. \<lbrace>?Q38 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>rv. einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>thread x. \<lbrace>?Q'38 thread x\<rbrace> lookupCap thread x \<lbrace>\<lambda>rv'. invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>thread x ft ft'. fr ft ft' \<Longrightarrow> corres dc (?E31 thread x ft) (?E'31 thread x ft') (handle_fault thread ft) (handleFault thread ft')
 7. \<And>thread x. \<lbrace>?Q31 thread x\<rbrace> cap_fault_on_failure x True (lookup_cap thread (to_bl x) >>=E case_cap (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word bool set. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word nat list. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word option nat. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>arch_cap. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E31 thread x\<rbrace>
 8. \<And>thread x. \<lbrace>?Q'31 thread x\<rbrace> capFaultOnFailure x True (lookupCap thread x >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E'31 thread x\<rbrace>
 9. \<And>thread. \<lbrace>?Q26 thread\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs and pspace_aligned and tcb_at thread and ?Q38 thread x and ?Q31 thread x\<rbrace>
 10. \<And>thread. \<lbrace>?Q'26 thread\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs' and pspace_aligned' and pspace_distinct' and tcb_at' thread and ?Q'38 thread x and ?Q'31 thread x\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>thread x41 x42 rights. corres (lfr \<oplus> dc) (?Q232 thread x41 x42 rights) (?Q'232 thread x41 x42 rights) (if AllowRead \<in> rights then doE ntfn <- liftE (get_notification x41);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap x41 x42 rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (case AllowRead \<in> rights of True \<Rightarrow> doE ntfn <- liftE (getNotification x41);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap x41 x42 (AllowWrite \<in> rights) True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0))
 2. \<And>thread x41 x42 x43 s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.NotificationCap x41 x42 x43)) s \<Longrightarrow> ?Q232 thread x41 x42 x43 s
 3. \<And>thread x41 x42 x43 s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) (AllowRead \<in> x43))) s \<Longrightarrow> ?Q'232 thread x41 x42 x43 s
 4. \<And>thread x. \<lbrace>?Q38 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>rv. einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>thread x. \<lbrace>?Q'38 thread x\<rbrace> lookupCap thread x \<lbrace>\<lambda>rv'. invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>thread x ft ft'. fr ft ft' \<Longrightarrow> corres dc (?E31 thread x ft) (?E'31 thread x ft') (handle_fault thread ft) (handleFault thread ft')
 7. \<And>thread x. \<lbrace>?Q31 thread x\<rbrace> cap_fault_on_failure x True (lookup_cap thread (to_bl x) >>=E case_cap (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word bool set. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word nat list. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word option nat. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>arch_cap. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E31 thread x\<rbrace>
 8. \<And>thread x. \<lbrace>?Q'31 thread x\<rbrace> capFaultOnFailure x True (lookupCap thread x >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E'31 thread x\<rbrace>
 9. \<And>thread. \<lbrace>?Q26 thread\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs and pspace_aligned and tcb_at thread and ?Q38 thread x and ?Q31 thread x\<rbrace>
 10. \<And>thread. \<lbrace>?Q'26 thread\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs' and pspace_aligned' and pspace_distinct' and tcb_at' thread and ?Q'38 thread x and ?Q'31 thread x\<rbrace>
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>thread x41 x42 rights. AllowRead \<in> rights \<Longrightarrow> corres (lfr \<oplus> dc) (?Q232 thread x41 x42 rights) (?Q'232 thread x41 x42 rights) (doE ntfn <- liftE (get_notification x41);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap x41 x42 rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE) (doE ntfn <- liftE (getNotification x41);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap x41 x42 (AllowWrite \<in> rights) True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE)
 2. \<And>thread x41 x42 rights. AllowRead \<notin> rights \<Longrightarrow> (\<exists>s. ?Q232 thread x41 x42 rights s \<and> (\<exists>s'. ?Q'232 thread x41 x42 rights s' \<and> (s, s') \<in> state_relation)) \<longrightarrow> Fault_H.lookup_failure.MissingCapability 0 = lookup_failure_map (ExceptionTypes_A.lookup_failure.MissingCapability 0)
 3. \<And>thread x41 x42 x43 s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.NotificationCap x41 x42 x43)) s \<Longrightarrow> ?Q232 thread x41 x42 x43 s
 4. \<And>thread x41 x42 x43 s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) (AllowRead \<in> x43))) s \<Longrightarrow> ?Q'232 thread x41 x42 x43 s
 5. \<And>thread x. \<lbrace>?Q38 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>rv. einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>thread x. \<lbrace>?Q'38 thread x\<rbrace> lookupCap thread x \<lbrace>\<lambda>rv'. invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>thread x ft ft'. fr ft ft' \<Longrightarrow> corres dc (?E31 thread x ft) (?E'31 thread x ft') (handle_fault thread ft) (handleFault thread ft')
 8. \<And>thread x. \<lbrace>?Q31 thread x\<rbrace> cap_fault_on_failure x True (lookup_cap thread (to_bl x) >>=E case_cap (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word bool set. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word nat list. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word option nat. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>arch_cap. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E31 thread x\<rbrace>
 9. \<And>thread x. \<lbrace>?Q'31 thread x\<rbrace> capFaultOnFailure x True (lookupCap thread x >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E'31 thread x\<rbrace>
 10. \<And>thread. \<lbrace>?Q26 thread\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs and pspace_aligned and tcb_at thread and ?Q38 thread x and ?Q31 thread x\<rbrace>
A total of 15 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread x41 x42 rights. AllowRead \<in> rights \<Longrightarrow> corres (lfr \<oplus> ntfn_relation) (?P243 thread x41 x42 rights) (?P'243 thread x41 x42 rights) (liftE (get_notification x41)) (liftE (getNotification x41))
 2. \<And>thread x41 x42 rights rv rv'. \<lbrakk>AllowRead \<in> rights; ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres (lfr \<oplus> dc) (?R243 thread x41 x42 rights rv) (?R'243 thread x41 x42 rights rv') (if ntfn_bound_tcb rv = Some thread \<or> ntfn_bound_tcb rv = None then liftE (receive_signal thread (cap.NotificationCap x41 x42 rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (if ntfnBoundTCB rv' = Some thread \<or> ntfnBoundTCB rv' = None then liftE (receiveSignal thread (capability.NotificationCap x41 x42 (AllowWrite \<in> rights) True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0))
 3. \<And>thread x41 x42 rights. AllowRead \<in> rights \<Longrightarrow> \<lbrace>?Q243 thread x41 x42 rights\<rbrace> liftE (get_notification x41) \<lbrace>?R243 thread x41 x42 rights\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>thread x41 x42 rights. AllowRead \<in> rights \<Longrightarrow> \<lbrace>?Q'243 thread x41 x42 rights\<rbrace> liftE (getNotification x41) \<lbrace>?R'243 thread x41 x42 rights\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>thread x41 x42 rights. AllowRead \<notin> rights \<Longrightarrow> (\<exists>s. (?P243 thread x41 x42 rights and ?Q243 thread x41 x42 rights) s \<and> (\<exists>s'. (?P'243 thread x41 x42 rights and ?Q'243 thread x41 x42 rights) s' \<and> (s, s') \<in> state_relation)) \<longrightarrow> Fault_H.lookup_failure.MissingCapability 0 = lookup_failure_map (ExceptionTypes_A.lookup_failure.MissingCapability 0)
 6. \<And>thread x41 x42 x43 s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.NotificationCap x41 x42 x43)) s \<Longrightarrow> (?P243 thread x41 x42 x43 and ?Q243 thread x41 x42 x43) s
 7. \<And>thread x41 x42 x43 s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) (AllowRead \<in> x43))) s \<Longrightarrow> (?P'243 thread x41 x42 x43 and ?Q'243 thread x41 x42 x43) s
 8. \<And>thread x. \<lbrace>?Q38 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>rv. einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>thread x. \<lbrace>?Q'38 thread x\<rbrace> lookupCap thread x \<lbrace>\<lambda>rv'. invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>thread x ft ft'. fr ft ft' \<Longrightarrow> corres dc (?E31 thread x ft) (?E'31 thread x ft') (handle_fault thread ft) (handleFault thread ft')
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread x41 x42 rights. AllowRead \<in> rights \<Longrightarrow> corres ntfn_relation (?P243 thread x41 x42 rights) (?P'243 thread x41 x42 rights) (get_notification x41) (getNotification x41)
 2. \<And>thread x41 x42 rights rv rv'. \<lbrakk>AllowRead \<in> rights; ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres (lfr \<oplus> dc) (?R243 thread x41 x42 rights rv) (?R'243 thread x41 x42 rights rv') (if ntfn_bound_tcb rv = Some thread \<or> ntfn_bound_tcb rv = None then liftE (receive_signal thread (cap.NotificationCap x41 x42 rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (if ntfnBoundTCB rv' = Some thread \<or> ntfnBoundTCB rv' = None then liftE (receiveSignal thread (capability.NotificationCap x41 x42 (AllowWrite \<in> rights) True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0))
 3. \<And>thread x41 x42 rights. AllowRead \<in> rights \<Longrightarrow> \<lbrace>?Q243 thread x41 x42 rights\<rbrace> liftE (get_notification x41) \<lbrace>?R243 thread x41 x42 rights\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>thread x41 x42 rights. AllowRead \<in> rights \<Longrightarrow> \<lbrace>?Q'243 thread x41 x42 rights\<rbrace> liftE (getNotification x41) \<lbrace>?R'243 thread x41 x42 rights\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>thread x41 x42 rights. AllowRead \<notin> rights \<Longrightarrow> (\<exists>s. (?P243 thread x41 x42 rights and ?Q243 thread x41 x42 rights) s \<and> (\<exists>s'. (?P'243 thread x41 x42 rights and ?Q'243 thread x41 x42 rights) s' \<and> (s, s') \<in> state_relation)) \<longrightarrow> Fault_H.lookup_failure.MissingCapability 0 = lookup_failure_map (ExceptionTypes_A.lookup_failure.MissingCapability 0)
 6. \<And>thread x41 x42 x43 s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.NotificationCap x41 x42 x43)) s \<Longrightarrow> (?P243 thread x41 x42 x43 and ?Q243 thread x41 x42 x43) s
 7. \<And>thread x41 x42 x43 s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) (AllowRead \<in> x43))) s \<Longrightarrow> (?P'243 thread x41 x42 x43 and ?Q'243 thread x41 x42 x43) s
 8. \<And>thread x. \<lbrace>?Q38 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>rv. einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>thread x. \<lbrace>?Q'38 thread x\<rbrace> lookupCap thread x \<lbrace>\<lambda>rv'. invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>thread x ft ft'. fr ft ft' \<Longrightarrow> corres dc (?E31 thread x ft) (?E'31 thread x ft') (handle_fault thread ft) (handleFault thread ft')
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>thread x41 x42 rights rv rv'. \<lbrakk>AllowRead \<in> rights; ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres (lfr \<oplus> dc) (?R243 thread x41 x42 rights rv) (?R'243 thread x41 x42 rights rv') (if ntfn_bound_tcb rv = Some thread \<or> ntfn_bound_tcb rv = None then liftE (receive_signal thread (cap.NotificationCap x41 x42 rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (if ntfnBoundTCB rv' = Some thread \<or> ntfnBoundTCB rv' = None then liftE (receiveSignal thread (capability.NotificationCap x41 x42 (AllowWrite \<in> rights) True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0))
 2. \<And>thread x41 x42 rights. AllowRead \<in> rights \<Longrightarrow> \<lbrace>?Q243 thread x41 x42 rights\<rbrace> liftE (get_notification x41) \<lbrace>?R243 thread x41 x42 rights\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>thread x41 x42 rights. AllowRead \<in> rights \<Longrightarrow> \<lbrace>?Q'243 thread x41 x42 rights\<rbrace> liftE (getNotification x41) \<lbrace>?R'243 thread x41 x42 rights\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>thread x41 x42 rights. AllowRead \<notin> rights \<Longrightarrow> (\<exists>s. (ntfn_at x41 and ?Q243 thread x41 x42 rights) s \<and> (\<exists>s'. (ntfn_at' x41 and ?Q'243 thread x41 x42 rights) s' \<and> (s, s') \<in> state_relation)) \<longrightarrow> Fault_H.lookup_failure.MissingCapability 0 = lookup_failure_map (ExceptionTypes_A.lookup_failure.MissingCapability 0)
 5. \<And>thread x41 x42 x43 s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.NotificationCap x41 x42 x43)) s \<Longrightarrow> (ntfn_at x41 and ?Q243 thread x41 x42 x43) s
 6. \<And>thread x41 x42 x43 s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) (AllowRead \<in> x43))) s \<Longrightarrow> (ntfn_at' x41 and ?Q'243 thread x41 x42 x43) s
 7. \<And>thread x. \<lbrace>?Q38 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>rv. einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>thread x. \<lbrace>?Q'38 thread x\<rbrace> lookupCap thread x \<lbrace>\<lambda>rv'. invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>thread x ft ft'. fr ft ft' \<Longrightarrow> corres dc (?E31 thread x ft) (?E'31 thread x ft') (handle_fault thread ft) (handleFault thread ft')
 10. \<And>thread x. \<lbrace>?Q31 thread x\<rbrace> cap_fault_on_failure x True (lookup_cap thread (to_bl x) >>=E case_cap (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word bool set. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word nat list. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word option nat. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>arch_cap. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E31 thread x\<rbrace>
A total of 17 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread x41 x42 rights rv rv'. \<lbrakk>AllowRead \<in> rights; ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> (ntfn_bound_tcb rv = Some thread \<or> ntfn_bound_tcb rv = None) = (ntfnBoundTCB rv' = Some thread \<or> ntfnBoundTCB rv' = None)
 2. \<And>thread x41 x42 rights rv rv'. \<lbrakk>AllowRead \<in> rights; ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres (lfr \<oplus> dc) (?P249 thread x41 x42 rights rv) (?P'252 thread x41 x42 rights rv') (liftE (receive_signal thread (cap.NotificationCap x41 x42 rights) isBlocking)) (liftE (receiveSignal thread (capability.NotificationCap x41 x42 (AllowWrite \<in> rights) True) isBlocking))
 3. \<And>thread x41 x42 rights rv rv'. \<lbrakk>AllowRead \<in> rights; ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres (lfr \<oplus> dc) (?Q250 thread x41 x42 rights rv) (?Q'253 thread x41 x42 rights rv') (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))
 4. \<And>thread x41 x42 rights. AllowRead \<in> rights \<Longrightarrow> \<lbrace>?Q243 thread x41 x42 rights\<rbrace> liftE (get_notification x41) \<lbrace>\<lambda>rv. if ntfn_bound_tcb rv = Some thread \<or> ntfn_bound_tcb rv = None then ?P249 thread x41 x42 rights rv else ?Q250 thread x41 x42 rights rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>thread x41 x42 rights. AllowRead \<in> rights \<Longrightarrow> \<lbrace>?Q'243 thread x41 x42 rights\<rbrace> liftE (getNotification x41) \<lbrace>\<lambda>rv'. if ntfnBoundTCB rv' = Some thread \<or> ntfnBoundTCB rv' = None then ?P'252 thread x41 x42 rights rv' else ?Q'253 thread x41 x42 rights rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>thread x41 x42 rights. AllowRead \<notin> rights \<Longrightarrow> (\<exists>s. (ntfn_at x41 and ?Q243 thread x41 x42 rights) s \<and> (\<exists>s'. (ntfn_at' x41 and ?Q'243 thread x41 x42 rights) s' \<and> (s, s') \<in> state_relation)) \<longrightarrow> Fault_H.lookup_failure.MissingCapability 0 = lookup_failure_map (ExceptionTypes_A.lookup_failure.MissingCapability 0)
 7. \<And>thread x41 x42 x43 s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.NotificationCap x41 x42 x43)) s \<Longrightarrow> (ntfn_at x41 and ?Q243 thread x41 x42 x43) s
 8. \<And>thread x41 x42 x43 s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) (AllowRead \<in> x43))) s \<Longrightarrow> (ntfn_at' x41 and ?Q'243 thread x41 x42 x43) s
 9. \<And>thread x. \<lbrace>?Q38 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>rv. einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>thread x. \<lbrace>?Q'38 thread x\<rbrace> lookupCap thread x \<lbrace>\<lambda>rv'. invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread x41 x42 rights rv rv'. \<lbrakk>AllowRead \<in> rights; ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres (lfr \<oplus> dc) (?P249 thread x41 x42 rights rv) (?P'252 thread x41 x42 rights rv') (liftE (receive_signal thread (cap.NotificationCap x41 x42 rights) isBlocking)) (liftE (receiveSignal thread (capability.NotificationCap x41 x42 (AllowWrite \<in> rights) True) isBlocking))
 2. \<And>thread x41 x42 rights rv rv'. \<lbrakk>AllowRead \<in> rights; ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres (lfr \<oplus> dc) (?Q250 thread x41 x42 rights rv) (?Q'253 thread x41 x42 rights rv') (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))
 3. \<And>thread x41 x42 rights. AllowRead \<in> rights \<Longrightarrow> \<lbrace>?Q243 thread x41 x42 rights\<rbrace> liftE (get_notification x41) \<lbrace>\<lambda>rv. if ntfn_bound_tcb rv = Some thread \<or> ntfn_bound_tcb rv = None then ?P249 thread x41 x42 rights rv else ?Q250 thread x41 x42 rights rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>thread x41 x42 rights. AllowRead \<in> rights \<Longrightarrow> \<lbrace>?Q'243 thread x41 x42 rights\<rbrace> liftE (getNotification x41) \<lbrace>\<lambda>rv'. if ntfnBoundTCB rv' = Some thread \<or> ntfnBoundTCB rv' = None then ?P'252 thread x41 x42 rights rv' else ?Q'253 thread x41 x42 rights rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>thread x41 x42 rights. AllowRead \<notin> rights \<Longrightarrow> (\<exists>s. (ntfn_at x41 and ?Q243 thread x41 x42 rights) s \<and> (\<exists>s'. (ntfn_at' x41 and ?Q'243 thread x41 x42 rights) s' \<and> (s, s') \<in> state_relation)) \<longrightarrow> Fault_H.lookup_failure.MissingCapability 0 = lookup_failure_map (ExceptionTypes_A.lookup_failure.MissingCapability 0)
 6. \<And>thread x41 x42 x43 s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.NotificationCap x41 x42 x43)) s \<Longrightarrow> (ntfn_at x41 and ?Q243 thread x41 x42 x43) s
 7. \<And>thread x41 x42 x43 s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) (AllowRead \<in> x43))) s \<Longrightarrow> (ntfn_at' x41 and ?Q'243 thread x41 x42 x43) s
 8. \<And>thread x. \<lbrace>?Q38 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>rv. einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>thread x. \<lbrace>?Q'38 thread x\<rbrace> lookupCap thread x \<lbrace>\<lambda>rv'. invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>thread x ft ft'. fr ft ft' \<Longrightarrow> corres dc (?E31 thread x ft) (?E'31 thread x ft') (handle_fault thread ft) (handleFault thread ft')
A total of 18 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread x41 x42 rights rv rv'. \<lbrakk>AllowRead \<in> rights; ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> is_ntfn_cap (cap.NotificationCap x41 x42 rights)
 2. \<And>thread x41 x42 rights rv rv'. \<lbrakk>AllowRead \<in> rights; ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> cap_relation (cap.NotificationCap x41 x42 rights) (capability.NotificationCap x41 x42 (AllowWrite \<in> rights) True)
 3. \<And>thread x41 x42 rights rv rv'. \<lbrakk>AllowRead \<in> rights; ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres (lfr \<oplus> dc) (?Q250 thread x41 x42 rights rv) (?Q'253 thread x41 x42 rights rv') (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))
 4. \<And>thread x41 x42 rights. AllowRead \<in> rights \<Longrightarrow> \<lbrace>?Q243 thread x41 x42 rights\<rbrace> liftE (get_notification x41) \<lbrace>\<lambda>rv. if ntfn_bound_tcb rv = Some thread \<or> ntfn_bound_tcb rv = None then invs and st_tcb_at active thread and valid_cap (cap.NotificationCap x41 x42 rights) and ex_nonz_cap_to thread else ?Q250 thread x41 x42 rights rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>thread x41 x42 rights. AllowRead \<in> rights \<Longrightarrow> \<lbrace>?Q'243 thread x41 x42 rights\<rbrace> liftE (getNotification x41) \<lbrace>\<lambda>rv'. if ntfnBoundTCB rv' = Some thread \<or> ntfnBoundTCB rv' = None then invs' and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> rights) True) else ?Q'253 thread x41 x42 rights rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>thread x41 x42 rights. AllowRead \<notin> rights \<Longrightarrow> (\<exists>s. (ntfn_at x41 and ?Q243 thread x41 x42 rights) s \<and> (\<exists>s'. (ntfn_at' x41 and ?Q'243 thread x41 x42 rights) s' \<and> (s, s') \<in> state_relation)) \<longrightarrow> Fault_H.lookup_failure.MissingCapability 0 = lookup_failure_map (ExceptionTypes_A.lookup_failure.MissingCapability 0)
 7. \<And>thread x41 x42 x43 s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.NotificationCap x41 x42 x43)) s \<Longrightarrow> (ntfn_at x41 and ?Q243 thread x41 x42 x43) s
 8. \<And>thread x41 x42 x43 s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) (AllowRead \<in> x43))) s \<Longrightarrow> (ntfn_at' x41 and ?Q'243 thread x41 x42 x43) s
 9. \<And>thread x. \<lbrace>?Q38 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>rv. einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>thread x. \<lbrace>?Q'38 thread x\<rbrace> lookupCap thread x \<lbrace>\<lambda>rv'. invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread x41 x42 rights rv rv'. \<lbrakk>AllowRead \<in> rights; ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres (lfr \<oplus> dc) (?Q250 thread x41 x42 rights rv) (?Q'253 thread x41 x42 rights rv') (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))
 2. \<And>thread x41 x42 rights rv rv'. \<lbrakk>AllowRead \<in> rights; ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> is_ntfn_cap (cap.NotificationCap x41 x42 rights)
 3. \<And>thread x41 x42 rights rv rv'. \<lbrakk>AllowRead \<in> rights; ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> cap_relation (cap.NotificationCap x41 x42 rights) (capability.NotificationCap x41 x42 (AllowWrite \<in> rights) True)
 4. \<And>thread x41 x42 rights. AllowRead \<in> rights \<Longrightarrow> \<lbrace>?Q243 thread x41 x42 rights\<rbrace> liftE (get_notification x41) \<lbrace>\<lambda>rv. if ntfn_bound_tcb rv = Some thread \<or> ntfn_bound_tcb rv = None then invs and st_tcb_at active thread and valid_cap (cap.NotificationCap x41 x42 rights) and ex_nonz_cap_to thread else ?Q250 thread x41 x42 rights rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>thread x41 x42 rights. AllowRead \<in> rights \<Longrightarrow> \<lbrace>?Q'243 thread x41 x42 rights\<rbrace> liftE (getNotification x41) \<lbrace>\<lambda>rv'. if ntfnBoundTCB rv' = Some thread \<or> ntfnBoundTCB rv' = None then invs' and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> rights) True) else ?Q'253 thread x41 x42 rights rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>thread x41 x42 rights. AllowRead \<notin> rights \<Longrightarrow> (\<exists>s. (ntfn_at x41 and ?Q243 thread x41 x42 rights) s \<and> (\<exists>s'. (ntfn_at' x41 and ?Q'243 thread x41 x42 rights) s' \<and> (s, s') \<in> state_relation)) \<longrightarrow> Fault_H.lookup_failure.MissingCapability 0 = lookup_failure_map (ExceptionTypes_A.lookup_failure.MissingCapability 0)
 7. \<And>thread x41 x42 x43 s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.NotificationCap x41 x42 x43)) s \<Longrightarrow> (ntfn_at x41 and ?Q243 thread x41 x42 x43) s
 8. \<And>thread x41 x42 x43 s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) (AllowRead \<in> x43))) s \<Longrightarrow> (ntfn_at' x41 and ?Q'243 thread x41 x42 x43) s
 9. \<And>thread x. \<lbrace>?Q38 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>rv. einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>thread x. \<lbrace>?Q'38 thread x\<rbrace> lookupCap thread x \<lbrace>\<lambda>rv'. invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread x41 x42 rights rv rv'. \<lbrakk>AllowRead \<in> rights; ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres (lfr \<oplus> dc) (\<lambda>_. True) (\<lambda>_. True) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))
 2. \<And>thread x41 x42 rights rv rv'. \<lbrakk>AllowRead \<in> rights; ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> is_ntfn_cap (cap.NotificationCap x41 x42 rights)
 3. \<And>thread x41 x42 rights rv rv'. \<lbrakk>AllowRead \<in> rights; ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> cap_relation (cap.NotificationCap x41 x42 rights) (capability.NotificationCap x41 x42 (AllowWrite \<in> rights) True)
 4. \<And>thread x41 x42 rights. AllowRead \<in> rights \<Longrightarrow> \<lbrace>?Q243 thread x41 x42 rights\<rbrace> liftE (get_notification x41) \<lbrace>\<lambda>rv. if ntfn_bound_tcb rv = Some thread \<or> ntfn_bound_tcb rv = None then invs and st_tcb_at active thread and valid_cap (cap.NotificationCap x41 x42 rights) and ex_nonz_cap_to thread else (\<lambda>_. True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>thread x41 x42 rights. AllowRead \<in> rights \<Longrightarrow> \<lbrace>?Q'243 thread x41 x42 rights\<rbrace> liftE (getNotification x41) \<lbrace>\<lambda>rv'. if ntfnBoundTCB rv' = Some thread \<or> ntfnBoundTCB rv' = None then invs' and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> rights) True) else (\<lambda>_. True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>thread x41 x42 rights. AllowRead \<notin> rights \<Longrightarrow> (\<exists>s. (ntfn_at x41 and ?Q243 thread x41 x42 rights) s \<and> (\<exists>s'. (ntfn_at' x41 and ?Q'243 thread x41 x42 rights) s' \<and> (s, s') \<in> state_relation)) \<longrightarrow> Fault_H.lookup_failure.MissingCapability 0 = lookup_failure_map (ExceptionTypes_A.lookup_failure.MissingCapability 0)
 7. \<And>thread x41 x42 x43 s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.NotificationCap x41 x42 x43)) s \<Longrightarrow> (ntfn_at x41 and ?Q243 thread x41 x42 x43) s
 8. \<And>thread x41 x42 x43 s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) (AllowRead \<in> x43))) s \<Longrightarrow> (ntfn_at' x41 and ?Q'243 thread x41 x42 x43) s
 9. \<And>thread x. \<lbrace>?Q38 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>rv. einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>thread x. \<lbrace>?Q'38 thread x\<rbrace> lookupCap thread x \<lbrace>\<lambda>rv'. invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 19 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>thread x41 x42 rights. AllowRead \<in> rights \<Longrightarrow> \<lbrace>?Q243 thread x41 x42 rights\<rbrace> get_notification x41 \<lbrace>\<lambda>rv. if ntfn_bound_tcb rv = Some thread \<or> ntfn_bound_tcb rv = None then invs and st_tcb_at active thread and valid_cap (cap.NotificationCap x41 x42 rights) and ex_nonz_cap_to thread else (\<lambda>_. True)\<rbrace>
 2. \<And>thread x41 x42 rights. AllowRead \<in> rights \<Longrightarrow> \<lbrace>?Q'243 thread x41 x42 rights\<rbrace> liftE (getNotification x41) \<lbrace>\<lambda>rv'. if ntfnBoundTCB rv' = Some thread \<or> ntfnBoundTCB rv' = None then invs' and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> rights) True) else (\<lambda>_. True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>thread x41 x42 rights. AllowRead \<notin> rights \<Longrightarrow> (\<exists>s. (ntfn_at x41 and ?Q243 thread x41 x42 rights) s \<and> (\<exists>s'. (ntfn_at' x41 and ?Q'243 thread x41 x42 rights) s' \<and> (s, s') \<in> state_relation)) \<longrightarrow> Fault_H.lookup_failure.MissingCapability 0 = lookup_failure_map (ExceptionTypes_A.lookup_failure.MissingCapability 0)
 4. \<And>thread x41 x42 x43 s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.NotificationCap x41 x42 x43)) s \<Longrightarrow> (ntfn_at x41 and ?Q243 thread x41 x42 x43) s
 5. \<And>thread x41 x42 x43 s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) (AllowRead \<in> x43))) s \<Longrightarrow> (ntfn_at' x41 and ?Q'243 thread x41 x42 x43) s
 6. \<And>thread x. \<lbrace>?Q38 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>rv. einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>thread x. \<lbrace>?Q'38 thread x\<rbrace> lookupCap thread x \<lbrace>\<lambda>rv'. invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>thread x ft ft'. fr ft ft' \<Longrightarrow> corres dc (?E31 thread x ft) (?E'31 thread x ft') (handle_fault thread ft) (handleFault thread ft')
 9. \<And>thread x. \<lbrace>?Q31 thread x\<rbrace> cap_fault_on_failure x True (lookup_cap thread (to_bl x) >>=E case_cap (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word bool set. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word nat list. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word option nat. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>arch_cap. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E31 thread x\<rbrace>
 10. \<And>thread x. \<lbrace>?Q'31 thread x\<rbrace> capFaultOnFailure x True (lookupCap thread x >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E'31 thread x\<rbrace>
A total of 16 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>thread x41 x42 rights. AllowRead \<notin> rights \<Longrightarrow> (\<exists>s. ntfn_at x41 s \<and> (\<forall>ntfn. (ntfn_bound_tcb ntfn = Some thread \<longrightarrow> ko_at (Notification ntfn) x41 s \<longrightarrow> invs s \<and> st_tcb_at active thread s \<and> s \<turnstile> cap.NotificationCap x41 x42 rights \<and> ex_nonz_cap_to thread s) \<and> (ntfn_bound_tcb ntfn = None \<longrightarrow> ko_at (Notification ntfn) x41 s \<longrightarrow> invs s \<and> st_tcb_at active thread s \<and> s \<turnstile> cap.NotificationCap x41 x42 rights \<and> ex_nonz_cap_to thread s)) \<and> (\<exists>s'. ntfn_at' x41 s' \<and> (\<forall>ntfn. (ntfnBoundTCB ntfn = Some thread \<longrightarrow> ko_at' ntfn x41 s' \<longrightarrow> invs' s' \<and> tcb_at' thread s' \<and> valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> rights) True) s') \<and> (ntfnBoundTCB ntfn = None \<longrightarrow> ko_at' ntfn x41 s' \<longrightarrow> invs' s' \<and> tcb_at' thread s' \<and> valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> rights) True) s')) \<and> (s, s') \<in> state_relation)) \<longrightarrow> Fault_H.lookup_failure.MissingCapability 0 = lookup_failure_map (ExceptionTypes_A.lookup_failure.MissingCapability 0)
 2. \<And>thread x41 x42 x43 s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.NotificationCap x41 x42 x43)) s \<Longrightarrow> (ntfn_at x41 and (\<lambda>s. \<forall>ntfn. ko_at (Notification ntfn) x41 s \<longrightarrow> (if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then invs and st_tcb_at active thread and valid_cap (cap.NotificationCap x41 x42 x43) and ex_nonz_cap_to thread else (\<lambda>_. True)) s)) s
 3. \<And>thread x41 x42 x43 s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) (AllowRead \<in> x43))) s \<Longrightarrow> (ntfn_at' x41 and (\<lambda>s. True \<and> (\<forall>ntfn. ko_at' ntfn x41 s \<longrightarrow> (if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then invs' and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) True) else (\<lambda>_. True)) s))) s
 4. \<And>thread x. \<lbrace>?Q38 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>rv. einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>thread x. \<lbrace>?Q'38 thread x\<rbrace> lookupCap thread x \<lbrace>\<lambda>rv'. invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>thread x ft ft'. fr ft ft' \<Longrightarrow> corres dc (?E31 thread x ft) (?E'31 thread x ft') (handle_fault thread ft) (handleFault thread ft')
 7. \<And>thread x. \<lbrace>?Q31 thread x\<rbrace> cap_fault_on_failure x True (lookup_cap thread (to_bl x) >>=E case_cap (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word bool set. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word nat list. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word option nat. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>arch_cap. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E31 thread x\<rbrace>
 8. \<And>thread x. \<lbrace>?Q'31 thread x\<rbrace> capFaultOnFailure x True (lookupCap thread x >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E'31 thread x\<rbrace>
 9. \<And>thread. \<lbrace>?Q26 thread\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs and pspace_aligned and tcb_at thread and ?Q38 thread x and ?Q31 thread x\<rbrace>
 10. \<And>thread. \<lbrace>?Q'26 thread\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs' and pspace_aligned' and pspace_distinct' and tcb_at' thread and ?Q'38 thread x and ?Q'31 thread x\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>thread x41 x42 x43 s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap (cap.NotificationCap x41 x42 x43)) s \<Longrightarrow> (ntfn_at x41 and (\<lambda>s. \<forall>ntfn. ko_at (Notification ntfn) x41 s \<longrightarrow> (if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then invs and st_tcb_at active thread and valid_cap (cap.NotificationCap x41 x42 x43) and ex_nonz_cap_to thread else (\<lambda>_. True)) s)) s
 2. \<And>thread x41 x42 x43 s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) (AllowRead \<in> x43))) s \<Longrightarrow> (ntfn_at' x41 and (\<lambda>s. True \<and> (\<forall>ntfn. ko_at' ntfn x41 s \<longrightarrow> (if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then invs' and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) True) else (\<lambda>_. True)) s))) s
 3. \<And>thread x. \<lbrace>?Q38 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>rv. einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>thread x. \<lbrace>?Q'38 thread x\<rbrace> lookupCap thread x \<lbrace>\<lambda>rv'. invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>thread x ft ft'. fr ft ft' \<Longrightarrow> corres dc (?E31 thread x ft) (?E'31 thread x ft') (handle_fault thread ft) (handleFault thread ft')
 6. \<And>thread x. \<lbrace>?Q31 thread x\<rbrace> cap_fault_on_failure x True (lookup_cap thread (to_bl x) >>=E case_cap (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word bool set. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word nat list. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word option nat. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>arch_cap. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E31 thread x\<rbrace>
 7. \<And>thread x. \<lbrace>?Q'31 thread x\<rbrace> capFaultOnFailure x True (lookupCap thread x >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E'31 thread x\<rbrace>
 8. \<And>thread. \<lbrace>?Q26 thread\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs and pspace_aligned and tcb_at thread and ?Q38 thread x and ?Q31 thread x\<rbrace>
 9. \<And>thread. \<lbrace>?Q'26 thread\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs' and pspace_aligned' and pspace_distinct' and tcb_at' thread and ?Q'38 thread x and ?Q'31 thread x\<rbrace>
 10. \<lbrace>?Q22\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. tcb_at thread and ?Q26 thread\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>thread x41 x42 x43 s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) (AllowRead \<in> x43))) s \<Longrightarrow> (ntfn_at' x41 and (\<lambda>s. True \<and> (\<forall>ntfn. ko_at' ntfn x41 s \<longrightarrow> (if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then invs' and tcb_at' thread and valid_cap' (capability.NotificationCap x41 x42 (AllowWrite \<in> x43) True) else (\<lambda>_. True)) s))) s
 2. \<And>thread x. \<lbrace>?Q38 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>rv. einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>thread x. \<lbrace>?Q'38 thread x\<rbrace> lookupCap thread x \<lbrace>\<lambda>rv'. invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>thread x ft ft'. fr ft ft' \<Longrightarrow> corres dc (?E31 thread x ft) (?E'31 thread x ft') (handle_fault thread ft) (handleFault thread ft')
 5. \<And>thread x. \<lbrace>?Q31 thread x\<rbrace> cap_fault_on_failure x True (lookup_cap thread (to_bl x) >>=E case_cap (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word bool set. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word nat list. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word option nat. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>arch_cap. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E31 thread x\<rbrace>
 6. \<And>thread x. \<lbrace>?Q'31 thread x\<rbrace> capFaultOnFailure x True (lookupCap thread x >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E'31 thread x\<rbrace>
 7. \<And>thread. \<lbrace>?Q26 thread\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs and pspace_aligned and tcb_at thread and ?Q38 thread x and ?Q31 thread x\<rbrace>
 8. \<And>thread. \<lbrace>?Q'26 thread\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs' and pspace_aligned' and pspace_distinct' and tcb_at' thread and ?Q'38 thread x and ?Q'31 thread x\<rbrace>
 9. \<lbrace>?Q22\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. tcb_at thread and ?Q26 thread\<rbrace>
 10. \<lbrace>?Q'22\<rbrace> getCurThread \<lbrace>\<lambda>thread. tcb_at' thread and ?Q'26 thread\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>thread x. \<lbrace>?Q38 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>rv. einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread) and valid_cap rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>thread x. \<lbrace>?Q'38 thread x\<rbrace> lookupCap thread x \<lbrace>\<lambda>rv'. invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread and valid_cap' rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>thread x ft ft'. fr ft ft' \<Longrightarrow> corres dc (?E31 thread x ft) (?E'31 thread x ft') (handle_fault thread ft) (handleFault thread ft')
 4. \<And>thread x. \<lbrace>?Q31 thread x\<rbrace> cap_fault_on_failure x True (lookup_cap thread (to_bl x) >>=E case_cap (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word bool set. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word nat list. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word option nat. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>arch_cap. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E31 thread x\<rbrace>
 5. \<And>thread x. \<lbrace>?Q'31 thread x\<rbrace> capFaultOnFailure x True (lookupCap thread x >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E'31 thread x\<rbrace>
 6. \<And>thread. \<lbrace>?Q26 thread\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs and pspace_aligned and tcb_at thread and ?Q38 thread x and ?Q31 thread x\<rbrace>
 7. \<And>thread. \<lbrace>?Q'26 thread\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs' and pspace_aligned' and pspace_distinct' and tcb_at' thread and ?Q'38 thread x and ?Q'31 thread x\<rbrace>
 8. \<lbrace>?Q22\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. tcb_at thread and ?Q26 thread\<rbrace>
 9. \<lbrace>?Q'22\<rbrace> getCurThread \<lbrace>\<lambda>thread. tcb_at' thread and ?Q'26 thread\<rbrace>
 10. \<And>s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s)) s \<Longrightarrow> ((\<lambda>_. True) and ?Q22) s
A total of 11 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>thread x ft ft'. fr ft ft' \<Longrightarrow> corres dc (?E31 thread x ft) (?E'31 thread x ft') (handle_fault thread ft) (handleFault thread ft')
 2. \<And>thread x. \<lbrace>?Q31 thread x\<rbrace> cap_fault_on_failure x True (lookup_cap thread (to_bl x) >>=E case_cap (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word bool set. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word nat list. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word option nat. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>arch_cap. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E31 thread x\<rbrace>
 3. \<And>thread x. \<lbrace>?Q'31 thread x\<rbrace> capFaultOnFailure x True (lookupCap thread x >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E'31 thread x\<rbrace>
 4. \<And>thread. \<lbrace>?Q26 thread\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs and pspace_aligned and tcb_at thread and (\<lambda>s. True \<and> (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread)) s \<and> valid_objs s) and ?Q31 thread x\<rbrace>
 5. \<And>thread. \<lbrace>?Q'26 thread\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs' and pspace_aligned' and pspace_distinct' and tcb_at' thread and (\<lambda>s. True \<and> (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread) s \<and> valid_objs' s) and ?Q'31 thread x\<rbrace>
 6. \<lbrace>?Q22\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. tcb_at thread and ?Q26 thread\<rbrace>
 7. \<lbrace>?Q'22\<rbrace> getCurThread \<lbrace>\<lambda>thread. tcb_at' thread and ?Q'26 thread\<rbrace>
 8. \<And>s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s)) s \<Longrightarrow> ((\<lambda>_. True) and ?Q22) s
 9. \<And>s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s)) s \<Longrightarrow> ((\<lambda>_. True) and ?Q'22) s proof (prove)
goal (9 subgoals):
 1. \<And>thread x ft ft'. fr ft ft' \<Longrightarrow> fr ft ft'
 2. \<And>thread x. \<lbrace>?Q31 thread x\<rbrace> cap_fault_on_failure x True (lookup_cap thread (to_bl x) >>=E case_cap (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word bool set. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word nat list. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word option nat. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>arch_cap. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault ft)\<rbrace>
 3. \<And>thread x. \<lbrace>?Q'31 thread x\<rbrace> capFaultOnFailure x True (lookupCap thread x >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft'. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 4. \<And>thread. \<lbrace>?Q26 thread\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs and pspace_aligned and tcb_at thread and (\<lambda>s. True \<and> (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread)) s \<and> valid_objs s) and ?Q31 thread x\<rbrace>
 5. \<And>thread. \<lbrace>?Q'26 thread\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs' and pspace_aligned' and pspace_distinct' and tcb_at' thread and (\<lambda>s. True \<and> (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread) s \<and> valid_objs' s) and ?Q'31 thread x\<rbrace>
 6. \<lbrace>?Q22\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. tcb_at thread and ?Q26 thread\<rbrace>
 7. \<lbrace>?Q'22\<rbrace> getCurThread \<lbrace>\<lambda>thread. tcb_at' thread and ?Q'26 thread\<rbrace>
 8. \<And>s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s)) s \<Longrightarrow> ((\<lambda>_. True) and ?Q22) s
 9. \<And>s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s)) s \<Longrightarrow> ((\<lambda>_. True) and ?Q'22) s proof (prove)
goal (8 subgoals):
 1. \<And>thread x. \<lbrace>?Q31 thread x\<rbrace> cap_fault_on_failure x True (lookup_cap thread (to_bl x) >>=E case_cap (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then liftE (do y <- delete_caller_cap thread;
receive_ipc thread (cap.EndpointCap ref badge rights) isBlocking
od) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>ref badge rights. if AllowRead \<in> rights then doE ntfn <- liftE (get_notification ref);
if ntfn_bound_tcb ntfn = Some thread \<or> ntfn_bound_tcb ntfn = None then liftE (receive_signal thread (cap.NotificationCap ref badge rights) isBlocking) else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)
odE else throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word bool set. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word nat list. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>word option nat. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0)) (\<lambda>arch_cap. throwError (ExceptionTypes_A.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault ft)\<rbrace>
 2. \<And>thread x. \<lbrace>?Q'31 thread x\<rbrace> capFaultOnFailure x True (lookupCap thread x >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft'. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 3. \<And>thread. \<lbrace>?Q26 thread\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs and pspace_aligned and tcb_at thread and (\<lambda>s. True \<and> (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread)) s \<and> valid_objs s) and ?Q31 thread x\<rbrace>
 4. \<And>thread. \<lbrace>?Q'26 thread\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs' and pspace_aligned' and pspace_distinct' and tcb_at' thread and (\<lambda>s. True \<and> (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread) s \<and> valid_objs' s) and ?Q'31 thread x\<rbrace>
 5. \<lbrace>?Q22\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. tcb_at thread and ?Q26 thread\<rbrace>
 6. \<lbrace>?Q'22\<rbrace> getCurThread \<lbrace>\<lambda>thread. tcb_at' thread and ?Q'26 thread\<rbrace>
 7. \<And>s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s)) s \<Longrightarrow> ((\<lambda>_. True) and ?Q22) s
 8. \<And>s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s)) s \<Longrightarrow> ((\<lambda>_. True) and ?Q'22) s proof (prove)
goal (8 subgoals):
 1. \<And>thread x. \<lbrace>?P'651 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>xa s. invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0)) \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0)) \<and> ((\<exists>x. AllowRead \<notin> x) \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0))) \<and> (\<forall>xa xb. (AllowRead \<in> xb \<longrightarrow> (\<forall>ntfn. ko_at (Notification ntfn) xa s \<longrightarrow> ntfn_bound_tcb ntfn \<noteq> Some thread \<and> (\<exists>y. ntfn_bound_tcb ntfn = Some y) \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0)))) \<and> (AllowRead \<notin> xb \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0)))) \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0))\<rbrace>, \<lbrace>\<lambda>rv s. valid_fault (ExceptionTypes_A.fault.CapFault x True rv)\<rbrace>
 2. \<And>thread x. \<lbrace>?Q'31 thread x\<rbrace> capFaultOnFailure x True (lookupCap thread x >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft'. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 3. \<And>thread. \<lbrace>?Q26 thread\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs and pspace_aligned and tcb_at thread and (\<lambda>s. True \<and> (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread)) s \<and> valid_objs s) and (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> ?P'651 thread x s)\<rbrace>
 4. \<And>thread. \<lbrace>?Q'26 thread\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs' and pspace_aligned' and pspace_distinct' and tcb_at' thread and (\<lambda>s. True \<and> (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread) s \<and> valid_objs' s) and ?Q'31 thread x\<rbrace>
 5. \<lbrace>?Q22\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. tcb_at thread and ?Q26 thread\<rbrace>
 6. \<lbrace>?Q'22\<rbrace> getCurThread \<lbrace>\<lambda>thread. tcb_at' thread and ?Q'26 thread\<rbrace>
 7. \<And>s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s)) s \<Longrightarrow> ((\<lambda>_. True) and ?Q22) s
 8. \<And>s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s)) s \<Longrightarrow> ((\<lambda>_. True) and ?Q'22) s proof (prove)
goal (9 subgoals):
 1. \<And>thread x. \<lbrace>?P661 thread x\<rbrace> lookup_cap thread (to_bl x) -, \<lbrace>\<lambda>rv s. valid_fault (ExceptionTypes_A.fault.CapFault x True rv)\<rbrace>
 2. \<And>thread x. \<lbrace>?P'661 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>xa s. invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0)) \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0)) \<and> ((\<exists>x. AllowRead \<notin> x) \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0))) \<and> (\<forall>xa xb. (AllowRead \<in> xb \<longrightarrow> (\<forall>ntfn. ko_at (Notification ntfn) xa s \<longrightarrow> ntfn_bound_tcb ntfn \<noteq> Some thread \<and> (\<exists>y. ntfn_bound_tcb ntfn = Some y) \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0)))) \<and> (AllowRead \<notin> xb \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0)))) \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0))\<rbrace>, -
 3. \<And>thread x. \<lbrace>?Q'31 thread x\<rbrace> capFaultOnFailure x True (lookupCap thread x >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft'. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 4. \<And>thread. \<lbrace>?Q26 thread\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs and pspace_aligned and tcb_at thread and (\<lambda>s. True \<and> (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread)) s \<and> valid_objs s) and (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> ?P661 thread x s \<and> ?P'661 thread x s)\<rbrace>
 5. \<And>thread. \<lbrace>?Q'26 thread\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs' and pspace_aligned' and pspace_distinct' and tcb_at' thread and (\<lambda>s. True \<and> (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread) s \<and> valid_objs' s) and ?Q'31 thread x\<rbrace>
 6. \<lbrace>?Q22\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. tcb_at thread and ?Q26 thread\<rbrace>
 7. \<lbrace>?Q'22\<rbrace> getCurThread \<lbrace>\<lambda>thread. tcb_at' thread and ?Q'26 thread\<rbrace>
 8. \<And>s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s)) s \<Longrightarrow> ((\<lambda>_. True) and ?Q22) s
 9. \<And>s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s)) s \<Longrightarrow> ((\<lambda>_. True) and ?Q'22) s proof (prove)
goal (9 subgoals):
 1. \<And>thread x. \<lbrace>?P661 thread x\<rbrace> doE (ref', uu_) <- doE tcb <- liftE (gets_the (get_tcb thread));
resolve_address_bits (tcb_ctable tcb, to_bl x)
odE;
liftE (get_cap ref')
odE -, \<lbrace>\<lambda>rv s. valid_fault (ExceptionTypes_A.fault.CapFault x True rv)\<rbrace>
 2. \<And>thread x. \<lbrace>?P'661 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>xa s. invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0)) \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0)) \<and> ((\<exists>x. AllowRead \<notin> x) \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0))) \<and> (\<forall>xa xb. (AllowRead \<in> xb \<longrightarrow> (\<forall>ntfn. ko_at (Notification ntfn) xa s \<longrightarrow> ntfn_bound_tcb ntfn \<noteq> Some thread \<and> (\<exists>y. ntfn_bound_tcb ntfn = Some y) \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0)))) \<and> (AllowRead \<notin> xb \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0)))) \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0))\<rbrace>, -
 3. \<And>thread x. \<lbrace>?Q'31 thread x\<rbrace> capFaultOnFailure x True (lookupCap thread x >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft'. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 4. \<And>thread. \<lbrace>?Q26 thread\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs and pspace_aligned and tcb_at thread and (\<lambda>s. True \<and> (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread)) s \<and> valid_objs s) and (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> ?P661 thread x s \<and> ?P'661 thread x s)\<rbrace>
 5. \<And>thread. \<lbrace>?Q'26 thread\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs' and pspace_aligned' and pspace_distinct' and tcb_at' thread and (\<lambda>s. True \<and> (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread) s \<and> valid_objs' s) and ?Q'31 thread x\<rbrace>
 6. \<lbrace>?Q22\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. tcb_at thread and ?Q26 thread\<rbrace>
 7. \<lbrace>?Q'22\<rbrace> getCurThread \<lbrace>\<lambda>thread. tcb_at' thread and ?Q'26 thread\<rbrace>
 8. \<And>s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s)) s \<Longrightarrow> ((\<lambda>_. True) and ?Q22) s
 9. \<And>s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s)) s \<Longrightarrow> ((\<lambda>_. True) and ?Q'22) s proof (prove)
goal (10 subgoals):
 1. \<And>thread x xa. \<lbrace>?B665 thread x xa\<rbrace> case xa of (ref', uu_) \<Rightarrow> liftE (get_cap ref') -, \<lbrace>\<lambda>rv s. valid_fault (ExceptionTypes_A.fault.CapFault x True rv)\<rbrace>
 2. \<And>thread x. \<lbrace>?P661 thread x\<rbrace> doE tcb <- liftE (gets_the (get_tcb thread));
resolve_address_bits (tcb_ctable tcb, to_bl x)
odE \<lbrace>?B665 thread x\<rbrace>, \<lbrace>\<lambda>rv s. valid_fault (ExceptionTypes_A.fault.CapFault x True rv)\<rbrace>
 3. \<And>thread x. \<lbrace>?P'661 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>xa s. invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0)) \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0)) \<and> ((\<exists>x. AllowRead \<notin> x) \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0))) \<and> (\<forall>xa xb. (AllowRead \<in> xb \<longrightarrow> (\<forall>ntfn. ko_at (Notification ntfn) xa s \<longrightarrow> ntfn_bound_tcb ntfn \<noteq> Some thread \<and> (\<exists>y. ntfn_bound_tcb ntfn = Some y) \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0)))) \<and> (AllowRead \<notin> xb \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0)))) \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0))\<rbrace>, -
 4. \<And>thread x. \<lbrace>?Q'31 thread x\<rbrace> capFaultOnFailure x True (lookupCap thread x >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft'. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 5. \<And>thread. \<lbrace>?Q26 thread\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs and pspace_aligned and tcb_at thread and (\<lambda>s. True \<and> (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread)) s \<and> valid_objs s) and (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> ?P661 thread x s \<and> ?P'661 thread x s)\<rbrace>
 6. \<And>thread. \<lbrace>?Q'26 thread\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs' and pspace_aligned' and pspace_distinct' and tcb_at' thread and (\<lambda>s. True \<and> (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread) s \<and> valid_objs' s) and ?Q'31 thread x\<rbrace>
 7. \<lbrace>?Q22\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. tcb_at thread and ?Q26 thread\<rbrace>
 8. \<lbrace>?Q'22\<rbrace> getCurThread \<lbrace>\<lambda>thread. tcb_at' thread and ?Q'26 thread\<rbrace>
 9. \<And>s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s)) s \<Longrightarrow> ((\<lambda>_. True) and ?Q22) s
 10. \<And>s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s)) s \<Longrightarrow> ((\<lambda>_. True) and ?Q'22) s proof (prove)
goal (10 subgoals):
 1. \<And>thread x xa. \<lbrace>?B665 thread x xa\<rbrace> liftE (get_cap (fst xa)) -, \<lbrace>\<lambda>rv s. valid_fault (ExceptionTypes_A.fault.CapFault x True rv)\<rbrace>
 2. \<And>thread x. \<lbrace>?P661 thread x\<rbrace> doE tcb <- liftE (gets_the (get_tcb thread));
resolve_address_bits (tcb_ctable tcb, to_bl x)
odE \<lbrace>?B665 thread x\<rbrace>, \<lbrace>\<lambda>rv s. valid_fault (ExceptionTypes_A.fault.CapFault x True rv)\<rbrace>
 3. \<And>thread x. \<lbrace>?P'661 thread x\<rbrace> lookup_cap thread (to_bl x) \<lbrace>\<lambda>xa s. invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0)) \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0)) \<and> ((\<exists>x. AllowRead \<notin> x) \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0))) \<and> (\<forall>xa xb. (AllowRead \<in> xb \<longrightarrow> (\<forall>ntfn. ko_at (Notification ntfn) xa s \<longrightarrow> ntfn_bound_tcb ntfn \<noteq> Some thread \<and> (\<exists>y. ntfn_bound_tcb ntfn = Some y) \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0)))) \<and> (AllowRead \<notin> xb \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0)))) \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0))\<rbrace>, -
 4. \<And>thread x. \<lbrace>?Q'31 thread x\<rbrace> capFaultOnFailure x True (lookupCap thread x >>=E case_capability (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>ntfnPtr x xa. case_bool (doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE) (throwError (Fault_H.lookup_failure.MissingCapability 0))) (\<lambda>word. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>x xa xb bool2 xc xd. case bool2 of True \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word zombie_type nat. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>arch_capability. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word bool1 bool2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>bool word nat1 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (\<lambda>word1 nat1 word2 nat2. throwError (Fault_H.lookup_failure.MissingCapability 0)) (throwError (Fault_H.lookup_failure.MissingCapability 0))) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft'. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 5. \<And>thread. \<lbrace>?Q26 thread\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs and pspace_aligned and tcb_at thread and (\<lambda>s. True \<and> (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread)) s \<and> valid_objs s) and (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> ?P661 thread x s \<and> ?P'661 thread x s)\<rbrace>
 6. \<And>thread. \<lbrace>?Q'26 thread\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs' and pspace_aligned' and pspace_distinct' and tcb_at' thread and (\<lambda>s. True \<and> (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread) s \<and> valid_objs' s) and ?Q'31 thread x\<rbrace>
 7. \<lbrace>?Q22\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. tcb_at thread and ?Q26 thread\<rbrace>
 8. \<lbrace>?Q'22\<rbrace> getCurThread \<lbrace>\<lambda>thread. tcb_at' thread and ?Q'26 thread\<rbrace>
 9. \<And>s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s)) s \<Longrightarrow> ((\<lambda>_. True) and ?Q22) s
 10. \<And>s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s)) s \<Longrightarrow> ((\<lambda>_. True) and ?Q'22) s proof (prove)
goal (8 subgoals):
 1. \<And>thread x xa. \<lbrace>?B729 thread x xa\<rbrace> case xa of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- liftE (getNotification ntfnPtr);
if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then liftE (receiveSignal thread (capability.NotificationCap ntfnPtr x xa True) isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0)
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0) | capability.EndpointCap x xa xb True xc xd \<Rightarrow> liftE (do y <- deleteCallerCap thread;
receiveIPC thread (capability.EndpointCap x xa xb True xc xd) isBlocking
od) | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0) | _ \<Rightarrow> throwError (Fault_H.lookup_failure.MissingCapability 0) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft s. invs' s \<and> sch_act_not thread s \<and> (\<forall>p. thread \<notin> set (ksReadyQueues s p)) \<and> st_tcb_at' simple' thread s \<and> ex_nonz_cap_to' thread s\<rbrace>
 2. \<And>thread x. \<lbrace>?Q'31 thread x\<rbrace> lookupCap thread x \<lbrace>?B729 thread x\<rbrace>, \<lbrace>\<lambda>ft s. invs' s \<and> sch_act_not thread s \<and> (\<forall>p. thread \<notin> set (ksReadyQueues s p)) \<and> st_tcb_at' simple' thread s \<and> ex_nonz_cap_to' thread s\<rbrace>
 3. \<And>thread. \<lbrace>?Q26 thread\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs and pspace_aligned and tcb_at thread and (\<lambda>s. True \<and> (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s) and tcb_at thread and (\<lambda>s. cur_thread s = thread)) s \<and> valid_objs s) and (\<lambda>s. invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> (get_tcb thread s \<noteq> None \<longrightarrow> (invs and valid_cap (fst (tcb_ctable (the (get_tcb thread s)), to_bl x))) s \<and> True) \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0)) \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0)) \<and> ((\<exists>x. AllowRead \<notin> x) \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0))) \<and> (\<forall>xa xb. (AllowRead \<in> xb \<longrightarrow> (\<forall>ntfn. ko_at (Notification ntfn) xa s \<longrightarrow> ntfn_bound_tcb ntfn \<noteq> Some thread \<and> (\<exists>y. ntfn_bound_tcb ntfn = Some y) \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0)))) \<and> (AllowRead \<notin> xb \<longrightarrow> invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0)))) \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> st_tcb_at active thread s \<and> ex_nonz_cap_to thread s \<and> valid_fault (ExceptionTypes_A.fault.CapFault x True (ExceptionTypes_A.lookup_failure.MissingCapability 0)))\<rbrace>
 4. \<And>thread. \<lbrace>?Q'26 thread\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. valid_objs' and pspace_aligned' and pspace_distinct' and tcb_at' thread and (\<lambda>s. True \<and> (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' thread) s \<and> valid_objs' s) and ?Q'31 thread x\<rbrace>
 5. \<lbrace>?Q22\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. tcb_at thread and ?Q26 thread\<rbrace>
 6. \<lbrace>?Q'22\<rbrace> getCurThread \<lbrace>\<lambda>thread. tcb_at' thread and ?Q'26 thread\<rbrace>
 7. \<And>s. (einvs and ct_active and (\<lambda>s. ex_nonz_cap_to (cur_thread s) s)) s \<Longrightarrow> ((\<lambda>_. True) and ?Q22) s
 8. \<And>s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s)) s \<Longrightarrow> ((\<lambda>_. True) and ?Q'22) s proof (prove)
goal (2 subgoals):
 1. \<And>s. invs s \<and> valid_list s \<and> valid_sched s \<and> ct_active s \<and> ex_nonz_cap_to (cur_thread s) s \<Longrightarrow> tcb_at (cur_thread s) s \<and> valid_objs s \<and> pspace_aligned s \<and> tcb_at (cur_thread s) s \<and> valid_objs s \<and> st_tcb_at active (cur_thread s) s \<and> ((\<exists>y. get_tcb (cur_thread s) s = Some y) \<longrightarrow> s \<turnstile> tcb_ctable (the (get_tcb (cur_thread s) s))) \<and> st_tcb_at active (cur_thread s) s \<and> ((\<exists>x. AllowRead \<notin> x) \<longrightarrow> st_tcb_at active (cur_thread s) s) \<and> (\<forall>x xa. (AllowRead \<in> xa \<longrightarrow> (\<forall>ntfn. ko_at (Notification ntfn) x s \<longrightarrow> ntfn_bound_tcb ntfn \<noteq> Some (cur_thread s) \<and> (\<exists>y. ntfn_bound_tcb ntfn = Some y) \<longrightarrow> st_tcb_at active (cur_thread s) s)) \<and> (AllowRead \<notin> xa \<longrightarrow> st_tcb_at active (cur_thread s) s)) \<and> st_tcb_at active (cur_thread s) s
 2. \<And>s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s)) s \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (valid_objs' and pspace_aligned' and pspace_distinct' and tcb_at' (ksCurThread s) and (\<lambda>sa. True \<and> (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' (ksCurThread s)) sa \<and> valid_objs' sa) and (\<lambda>sa. invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> (\<forall>x. invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> True) \<and> (invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> True) \<and> (\<forall>x xa xb xc. (\<forall>ntfn. ko_at' ntfn x sa \<longrightarrow> (ntfnBoundTCB ntfn = Some (ksCurThread s) \<or> ntfnBoundTCB ntfn = None \<longrightarrow> True) \<and> (\<not> (ntfnBoundTCB ntfn = Some (ksCurThread s) \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> True)) \<and> invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> True) \<and> (\<forall>x. invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> True) \<and> (\<forall>x xa xb xc xd xe. True \<and> invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> True) \<and> (invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> True) \<and> (\<forall>x xa xb. invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> True) \<and> (\<forall>x. invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> True) \<and> (\<forall>x xa xb. invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> True) \<and> (\<forall>x xa xb xc. invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> True) \<and> (\<forall>x xa xb xc. invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> True) \<and> invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> True))) s)) s proof (prove)
goal (1 subgoal):
 1. \<And>s. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s)) s \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (valid_objs' and pspace_aligned' and pspace_distinct' and tcb_at' (ksCurThread s) and (\<lambda>sa. True \<and> (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and (\<lambda>s. ex_nonz_cap_to' (ksCurThread s) s) and tcb_at' (ksCurThread s)) sa \<and> valid_objs' sa) and (\<lambda>sa. invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> (\<forall>x. invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> True) \<and> (invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> True) \<and> (\<forall>x xa xb xc. (\<forall>ntfn. ko_at' ntfn x sa \<longrightarrow> (ntfnBoundTCB ntfn = Some (ksCurThread s) \<or> ntfnBoundTCB ntfn = None \<longrightarrow> True) \<and> (\<not> (ntfnBoundTCB ntfn = Some (ksCurThread s) \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> True)) \<and> invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> True) \<and> (\<forall>x. invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> True) \<and> (\<forall>x xa xb xc xd xe. True \<and> invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> True) \<and> (invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> True) \<and> (\<forall>x xa xb. invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> True) \<and> (\<forall>x. invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> True) \<and> (\<forall>x xa xb. invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> True) \<and> (\<forall>x xa xb xc. invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> True) \<and> (\<forall>x xa xb xc. invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> True) \<and> invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> True))) s)) s proof (prove)
goal:
No subgoals!