theory Syscall_C

lemma handleRecv_ccorres:
  notes rf_sr_upd_safe[simp del]
  shows
  "ccorres dc xfdc
       (\<lambda>s. invs' s \<and> st_tcb_at' simple' (ksCurThread s) s
               \<and> sch_act_sane s \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)))
       {s. isBlocking_' s = from_bool isBlocking}
       []
       (handleRecv isBlocking)
       (Call handleRecv_'proc)" supply if_cong[cong] option.case_cong[cong] apply (cinit lift: isBlocking_') apply (rule ccorres_pre_getCurThread) apply (ctac) apply (simp add: catch_def) apply (simp add: capFault_bindE) apply (simp add: bindE_bind_linearise) apply (rule_tac xf'=lu_ret___struct_lookupCap_ret_C_'
                        in ccorres_split_nothrow_case_sum) apply (rule  capFaultOnFailure_ccorres) apply (ctac add: lookupCap_ccorres) apply ceqv apply clarsimp apply (rule ccorres_Catch) apply csymbr apply (simp add: cap_get_tag_isCap del: Collect_const) apply (clarsimp simp: cap_case_EndpointCap_NotificationCap
                              capFaultOnFailure_if_case_sum) apply (rule ccorres_cond_both' [where Q=\<top> and Q'=\<top>]) apply clarsimp apply (rule ccorres_rhs_assoc)+ apply csymbr apply (simp add: case_bool_If capFaultOnFailure_if_case_sum) apply (rule ccorres_if_cond_throws_break2 [where Q=\<top> and Q'=\<top>]) apply clarsimp apply (simp add: cap_get_tag_isCap[symmetric] cap_get_tag_EndpointCap
                        del: Collect_const) apply (simp add: to_bool_def) apply (rule ccorres_rhs_assoc)+ apply (simp add: capFaultOnFailure_def rethrowFailure_def
                            handleE'_def throwError_def) apply (rule ccorres_cross_over_guard[where P=\<top>]) apply (rule ccorres_symb_exec_r) apply (rule ccorres_cross_over_guard[where P=\<top>]) apply (rule ccorres_symb_exec_r) apply (rule ccorres_add_return2) apply (rule ccorres_split_nothrow_call[where xf'=xfdc and d'="\<lambda>_. break_C"
                                                      and Q="\<lambda>_ _. True" and Q'="\<lambda>_ _. UNIV"]) apply (ctac add: handleFault_ccorres) apply simp+ apply ceqv apply (rule ccorres_break_return) apply simp+ apply wp apply (vcg exspec=handleFault_modifies) apply vcg apply (rule conseqPre, vcg) apply (clarsimp simp: rf_sr_upd_safe) apply vcg apply (rule conseqPre, vcg) apply (clarsimp simp: rf_sr_upd_safe) apply (simp add: liftE_bind) apply (ctac) apply (rule_tac P="\<lambda>s. ksCurThread s = thread" in ccorres_cross_over_guard) apply (ctac add: receiveIPC_ccorres) apply (wp deleteCallerCap_ksQ_ct' hoare_vcg_all_lift) apply (rule conseqPost[where Q'=UNIV and A'="{}"], vcg exspec=deleteCallerCap_modifies) apply (clarsimp dest!: rf_sr_ksCurThread) apply simp apply clarsimp apply (vcg exspec=handleFault_modifies) apply (clarsimp simp: case_bool_If capFaultOnFailure_if_case_sum capFault_bindE) apply (simp add: liftE_bindE bind_bindE_assoc bind_assoc) apply (rule ccorres_cond_both' [where Q=\<top> and Q'=\<top>]) apply clarsimp apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply csymbr apply csymbr apply (rename_tac thread epCPtr rv rva ntfnptr) apply (rule_tac P="valid_cap' rv" in ccorres_cross_over_guard) apply (simp only: capFault_injection injection_handler_If injection_liftE
                            injection_handler_throwError if_to_top_of_bind) apply csymbr apply (rule ccorres_abstract_cleanup) apply csymbr apply csymbr apply (rule ccorres_if_lhs) apply (rule ccorres_pre_getNotification) apply (rename_tac ntfn) apply (rule_tac Q="valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s)"
                      and Q'="\<lambda>s. ret__unsigneda = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))"
                in ccorres_if_cond_throws_break2) apply (clarsimp simp: cap_get_tag_isCap[symmetric] cap_get_tag_NotificationCap
                                     option_to_ctcb_ptr_valid_ntfn rf_sr_ksCurThread) apply (auto simp: option_to_ctcb_ptr_def)[1] apply (rule ccorres_rhs_assoc)+ apply (simp add: capFaultOnFailure_def rethrowFailure_def
                               handleE'_def throwError_def) apply (rule ccorres_cross_over_guard[where P=\<top>]) apply (rule ccorres_symb_exec_r) apply (rule ccorres_cross_over_guard[where P=\<top>]) apply (rule ccorres_symb_exec_r) apply (rule ccorres_add_return2) apply (rule ccorres_split_nothrow_call[where xf'=xfdc and d'="\<lambda>_. break_C"
                                               and Q="\<lambda>_ _. True" and Q'="\<lambda>_ _. UNIV"]) apply (ctac add: handleFault_ccorres) apply simp+ apply ceqv apply (rule ccorres_break_return) apply simp+ apply wp apply (vcg exspec=handleFault_modifies) apply vcg apply (rule conseqPre, vcg) apply (clarsimp simp: rf_sr_upd_safe) apply vcg apply (rule conseqPre, vcg) apply (clarsimp simp: rf_sr_upd_safe) apply (simp add: liftE_bind) apply (ctac  add: receiveSignal_ccorres) apply clarsimp apply (vcg exspec=handleFault_modifies) apply (rule ccorres_cond_true_seq) apply (rule ccorres_split_throws) apply (rule ccorres_rhs_assoc)+ apply (simp add: capFaultOnFailure_def rethrowFailure_def
                                      handleE'_def throwError_def) apply (rule ccorres_cross_over_guard[where P=\<top>]) apply (rule ccorres_symb_exec_r) apply (rule ccorres_cross_over_guard[where P=\<top>]) apply (rule ccorres_symb_exec_r) apply (rule ccorres_add_return2) apply (ctac add: handleFault_ccorres) apply (rule ccorres_break_return[where P=\<top> and P'=UNIV]) apply simp+ apply wp apply (vcg exspec=handleFault_modifies) apply vcg apply (rule conseqPre, vcg) apply (clarsimp simp: rf_sr_upd_safe) apply vcg apply (rule conseqPre, vcg) apply (clarsimp simp: rf_sr_upd_safe) apply (vcg exspec=handleFault_modifies) apply (simp add: capFaultOnFailure_def rethrowFailure_def
                         handleE'_def throwError_def) apply (rule ccorres_rhs_assoc)+ apply (rule ccorres_cross_over_guard[where P=\<top>]) apply (rule ccorres_symb_exec_r) apply (rule ccorres_cross_over_guard[where P=\<top>]) apply (rule ccorres_symb_exec_r) apply (ctac add: handleFault_ccorres) apply vcg apply (rule conseqPre, vcg) apply (clarsimp simp: rf_sr_upd_safe) apply vcg apply (rule conseqPre, vcg) apply (clarsimp simp: rf_sr_upd_safe) apply clarsimp apply (rule ccorres_add_return2) apply (rule ccorres_rhs_assoc)+ apply (rule ccorres_cross_over_guard[where P=\<top>]) apply (rule ccorres_symb_exec_r) apply (ctac add: handleFault_ccorres) apply (rule ccorres_split_throws) apply (rule ccorres_return_void_C) apply vcg apply wp apply (vcg exspec=handleFault_modifies) apply vcg apply (rule conseqPre, vcg) apply (clarsimp simp: rf_sr_upd_safe) apply (wp) apply clarsimp apply (rename_tac thread epCPtr) apply (rule_tac Q'="(\<lambda>rv s. invs' s \<and> st_tcb_at' simple' thread s
               \<and> sch_act_sane s \<and> (\<forall>p. thread \<notin> set (ksReadyQueues s p)) \<and> thread = ksCurThread s
               \<and> valid_cap' rv s)" in hoare_post_imp_R[rotated]) apply (clarsimp simp: sch_act_sane_def) apply (auto dest!: obj_at_valid_objs'[OF _ invs_valid_objs']
                      simp: projectKOs valid_obj'_def,
                auto simp: pred_tcb_at'_def obj_at'_def objBits_simps projectKOs ct_in_state'_def)[1] apply wp apply clarsimp apply (vcg exspec=isStopped_modifies exspec=lookupCap_modifies) apply wp apply clarsimp apply vcg apply (clarsimp simp add: sch_act_sane_def) apply (simp add: cap_get_tag_isCap[symmetric] del: rf_sr_upd_safe) apply (simp add: Kernel_C.capRegister_def ARM_H.capRegister_def ct_in_state'_def
                   ARM.capRegister_def Kernel_C.R0_def
                   tcb_at_invs') apply (frule invs_valid_objs') apply (frule tcb_aligned'[OF tcb_at_invs']) apply clarsimp apply (intro conjI impI allI) apply (clarsimp simp: cfault_rel_def seL4_Fault_CapFault_lift
                            lookup_fault_missing_capability_lift is_cap_fault_def)+ apply (clarsimp simp: cap_get_tag_NotificationCap) apply (rule cmap_relationE1[OF cmap_relation_ntfn], assumption, erule ko_at_projectKO_opt) apply (clarsimp simp: cnotification_relation_def Let_def) apply (clarsimp simp: cfault_rel_def seL4_Fault_CapFault_lift
                                 lookup_fault_missing_capability_lift is_cap_fault_def)+ apply (clarsimp simp: cap_get_tag_NotificationCap) apply (simp add: ccap_relation_def to_bool_def) apply (clarsimp simp: cap_get_tag_NotificationCap valid_cap'_def) apply (drule obj_at_ko_at', clarsimp) apply (rule cmap_relationE1[OF cmap_relation_ntfn], assumption, erule ko_at_projectKO_opt) apply (clarsimp simp: typ_heap_simps) apply (clarsimp simp: cfault_rel_def seL4_Fault_CapFault_lift
                            lookup_fault_missing_capability_lift is_cap_fault_def)+ apply (case_tac w, clarsimp+) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (\<lambda>s. invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) \<lbrace>\<acute>isBlocking = from_bool isBlocking\<rbrace> [] (handleRecv isBlocking) (Call handleRecv_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (\<lambda>s. invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) \<lbrace>\<acute>isBlocking = from_bool isBlocking\<rbrace> [] (handleRecv isBlocking) (Call handleRecv_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>isBlockinga. isBlockinga = from_bool isBlocking \<Longrightarrow> ccorres dc xfdc (?Q1442 isBlockinga) (?Q'1442 isBlockinga) [SKIP] (do thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
capFaultOnFailure epCPtr True (doE epCap <- lookupCap thread epCPtr;
case epCap of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread epCap isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread epCap isBlocking
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
odE) <catch> handleFault thread
od) (\<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister);;
(\<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,\<acute>epCPtr);;
(IF lookupCap_ret_C.status_C \<acute>lu_ret___struct_lookupCap_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C,isBlockinga)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C,isBlockinga)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)))
 2. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1442 isBlockinga s \<and> s' \<in> ?Q'1442 isBlockinga proof (prove)
goal (2 subgoals):
 1. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> ccorres dc xfdc (?P1448 isBlockinga thread) (?P'1448 isBlockinga thread) [SKIP] (do epCPtr <- asUser thread (getRegister Thread_H.capRegister);
capFaultOnFailure epCPtr True (doE epCap <- lookupCap thread epCPtr;
case epCap of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread epCap isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread epCap isBlocking
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
odE) <catch> handleFault thread
od) (\<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister);;
(\<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,\<acute>epCPtr);;
(IF lookupCap_ret_C.status_C \<acute>lu_ret___struct_lookupCap_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C,isBlockinga)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C,isBlockinga)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)))
 2. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ?P1448 isBlockinga rv s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> ?P'1448 isBlockinga rv} proof (prove)
goal (4 subgoals):
 1. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1452 isBlockinga thread rv) (?Q'1452 isBlockinga thread rv epCPtr) [SKIP] (capFaultOnFailure rv True (doE epCap <- lookupCap thread rv;
case epCap of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread epCap isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread epCap isBlocking
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
odE) <catch> handleFault thread) (\<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr);;
(IF lookupCap_ret_C.status_C \<acute>lu_ret___struct_lookupCap_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C,isBlockinga)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C,isBlockinga)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END))
 2. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>?Q1452 isBlockinga thread\<rbrace>
 3. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> ?Q'1452 isBlockinga thread rv (epCPtr_' s)}
 4. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (4 subgoals):
 1. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1452 (from_bool isBlocking) thread epCPtr) (?Q'1452 (from_bool isBlocking) thread epCPtr epCPtr) [SKIP] (do x <- capFaultOnFailure epCPtr True (doE epCap <- lookupCap thread epCPtr;
case epCap of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread epCap isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread epCap isBlocking
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
odE);
case x of Inl e \<Rightarrow> handleFault thread e | Inr b \<Rightarrow> return b
od) (\<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr);;
(IF lookupCap_ret_C.status_C \<acute>lu_ret___struct_lookupCap_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C,from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C,from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END))
 2. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>?Q1452 isBlockinga thread\<rbrace>
 3. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> ?Q'1452 isBlockinga thread rv (epCPtr_' s)}
 4. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (4 subgoals):
 1. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1452 (from_bool isBlocking) thread epCPtr) (?Q'1452 (from_bool isBlocking) thread epCPtr epCPtr) [SKIP] (do x <- doE rv <- capFaultOnFailure epCPtr True (lookupCap thread epCPtr);
capFaultOnFailure epCPtr True (case rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rv isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread rv isBlocking
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0)
odE;
case x of Inl e \<Rightarrow> handleFault thread e | Inr b \<Rightarrow> return b
od) (\<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr);;
(IF lookupCap_ret_C.status_C \<acute>lu_ret___struct_lookupCap_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C,from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C,from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END))
 2. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>?Q1452 isBlockinga thread\<rbrace>
 3. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> ?Q'1452 isBlockinga thread rv (epCPtr_' s)}
 4. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (4 subgoals):
 1. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1452 (from_bool isBlocking) thread epCPtr) (?Q'1452 (from_bool isBlocking) thread epCPtr epCPtr) [SKIP] (capFaultOnFailure epCPtr True (lookupCap thread epCPtr) >>= case_sum (case_sum (handleFault thread) return \<circ> Inl) (\<lambda>rv. capFaultOnFailure epCPtr True (case rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rv isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread rv isBlocking
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0) >>= case_sum (handleFault thread) return)) (\<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr);;
(IF lookupCap_ret_C.status_C \<acute>lu_ret___struct_lookupCap_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C,from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C,from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END))
 2. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>?Q1452 isBlockinga thread\<rbrace>
 3. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> ?Q'1452 isBlockinga thread rv (epCPtr_' s)}
 4. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (9 subgoals):
 1. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> ccorres (?f'2154 isBlockinga thread rv epCPtr \<currency> ?r'2154 isBlockinga thread rv epCPtr) (liftxf (?es2154 isBlockinga thread rv epCPtr) (?ef'2154 isBlockinga thread rv epCPtr) (?vf'2154 isBlockinga thread rv epCPtr) lu_ret___struct_lookupCap_ret_C_') (?P2166 (from_bool isBlocking) thread epCPtr) (?P'2159 (from_bool isBlocking) thread epCPtr epCPtr) [SKIP] (capFaultOnFailure epCPtr True (lookupCap thread epCPtr)) (\<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr))
 2. \<And>isBlockinga thread rv epCPtr rv' t t'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> lu_ret___struct_lookupCap_ret_C_' rv' t t' (IF lookupCap_ret_C.status_C \<acute>lu_ret___struct_lookupCap_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C,from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C,from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END) (?d'2154 isBlockinga thread rv epCPtr rv')
 3. \<And>isBlockinga thread rv epCPtr rva rv'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; ?r'2154 isBlockinga thread rv epCPtr rva (?vf'2154 isBlockinga thread rv epCPtr rv'); ?ef'2154 isBlockinga thread rv epCPtr rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2154 isBlockinga thread rv epCPtr rva) (?Q'2154 isBlockinga thread rv epCPtr rva rv') [SKIP] (do a <- capFaultOnFailure epCPtr True (case rva of capability.NotificationCap ntfnPtr x xa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread rva isBlocking
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (?d'2154 isBlockinga thread rv epCPtr rv')
 4. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; ?ef'2154 isBlockinga thread rv epCPtr rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ?f'2154 isBlockinga thread rv epCPtr err (?ef'2154 isBlockinga thread rv epCPtr rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (?d'2154 isBlockinga thread rv epCPtr rv')
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>?Q2154 isBlockinga thread rv epCPtr\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. ?ef'2154 isBlockinga thread rv epCPtr (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ?r'2154 isBlockinga thread rv epCPtr rv' (?vf'2154 isBlockinga thread rv epCPtr (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> ?Q'2154 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s)) \<and> (\<forall>ft. ?ef'2154 isBlockinga thread rv epCPtr (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ?f'2154 isBlockinga thread rv epCPtr ft (?ef'2154 isBlockinga thread rv epCPtr (lu_ret___struct_lookupCap_ret_C_' s)) (?es2154 isBlockinga thread rv epCPtr s) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (?es2154 isBlockinga thread rv epCPtr s))}
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. ?P2166 isBlockinga thread a and ?R2164 isBlockinga thread a\<rbrace>
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> ?P'2159 isBlockinga thread rv (epCPtr_' s) \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 9. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (9 subgoals):
 1. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>a b c. ?f2171 isBlockinga thread rv epCPtr b c a) \<currency> ?r'2154 isBlockinga thread rv epCPtr) (liftxf (?es2154 isBlockinga thread rv epCPtr) (?ef'2154 isBlockinga thread rv epCPtr) (?vf'2154 isBlockinga thread rv epCPtr) lu_ret___struct_lookupCap_ret_C_') (?P2166 (from_bool isBlocking) thread epCPtr) (?P'2159 (from_bool isBlocking) thread epCPtr epCPtr) [SKIP] (lookupCap thread epCPtr) (\<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr))
 2. \<And>isBlockinga thread rv epCPtr rv' t t'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> lu_ret___struct_lookupCap_ret_C_' rv' t t' (IF lookupCap_ret_C.status_C \<acute>lu_ret___struct_lookupCap_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C,from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C,from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END) (?d'2154 isBlockinga thread rv epCPtr rv')
 3. \<And>isBlockinga thread rv epCPtr rva rv'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; ?r'2154 isBlockinga thread rv epCPtr rva (?vf'2154 isBlockinga thread rv epCPtr rv'); ?ef'2154 isBlockinga thread rv epCPtr rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2154 isBlockinga thread rv epCPtr rva) (?Q'2154 isBlockinga thread rv epCPtr rva rv') [SKIP] (do a <- capFaultOnFailure epCPtr True (case rva of capability.NotificationCap ntfnPtr x xa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread rva isBlocking
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (?d'2154 isBlockinga thread rv epCPtr rv')
 4. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; ?ef'2154 isBlockinga thread rv epCPtr rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> ?f2171 isBlockinga thread rv epCPtr (?ef'2154 isBlockinga thread rv epCPtr rv') err' w\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (?d'2154 isBlockinga thread rv epCPtr rv')
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>?Q2154 isBlockinga thread rv epCPtr\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. ?ef'2154 isBlockinga thread rv epCPtr (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ?r'2154 isBlockinga thread rv epCPtr rv' (?vf'2154 isBlockinga thread rv epCPtr (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> ?Q'2154 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s)) \<and> (\<forall>ft. ?ef'2154 isBlockinga thread rv epCPtr (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> ?f2171 isBlockinga thread rv epCPtr (?ef'2154 isBlockinga thread rv epCPtr (lu_ret___struct_lookupCap_ret_C_' s)) (?es2154 isBlockinga thread rv epCPtr s) w) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (?es2154 isBlockinga thread rv epCPtr s))}
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. ?P2166 isBlockinga thread a and ?R2164 isBlockinga thread a\<rbrace>
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> ?P'2159 isBlockinga thread rv (epCPtr_' s) \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 9. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (8 subgoals):
 1. \<And>isBlockinga thread rv epCPtr rv' t t'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> lu_ret___struct_lookupCap_ret_C_' rv' t t' (IF lookupCap_ret_C.status_C \<acute>lu_ret___struct_lookupCap_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C,from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C);;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C,from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END) (?d'2154 isBlockinga thread rv epCPtr rv')
 2. \<And>isBlockinga thread rv epCPtr rva rv'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2154 isBlockinga thread rv epCPtr rva) (?Q'2154 isBlockinga thread rv epCPtr rva rv') [SKIP] (do a <- capFaultOnFailure epCPtr True (case rva of capability.NotificationCap ntfnPtr x xa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread rva isBlocking
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (?d'2154 isBlockinga thread rv epCPtr rv')
 3. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (?d'2154 isBlockinga thread rv epCPtr rv')
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>?Q2154 isBlockinga thread rv epCPtr\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> ?Q'2154 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s)) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 8. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (7 subgoals):
 1. \<And>isBlockinga thread rv epCPtr rva rv'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2154 isBlockinga thread rv epCPtr rva) (?Q'2154 isBlockinga thread rv epCPtr rva rv') [SKIP] (do a <- capFaultOnFailure epCPtr True (case rva of capability.NotificationCap ntfnPtr x xa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread rva isBlocking
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 2. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 3. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>?Q2154 isBlockinga thread rv epCPtr\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> ?Q'2154 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s)) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 5. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 7. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (7 subgoals):
 1. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2154 (from_bool isBlocking) thread epCPtr epCPtr rva) (?Q'2154 (from_bool isBlocking) thread epCPtr epCPtr rva rv') [SKIP] (capFaultOnFailure epCPtr True (case rva of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread rva isBlocking
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0) >>= case_sum (handleFault thread) return) (TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 2. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 3. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>?Q2154 isBlockinga thread rv epCPtr\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> ?Q'2154 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s)) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 5. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 7. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (7 subgoals):
 1. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2154 (from_bool isBlocking) thread epCPtr epCPtr rva) (?Q'2154 (from_bool isBlocking) thread epCPtr epCPtr rva rv') [catchbrk_C, SKIP] (capFaultOnFailure epCPtr True (case rva of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread rva isBlocking
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0) >>= case_sum (handleFault thread) return) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI)
 2. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 3. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>?Q2154 isBlockinga thread rv epCPtr\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> ?Q'2154 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s)) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 5. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 7. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (7 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (lookupCap_ret_C.cap_C rv')\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2154 (from_bool isBlocking) thread epCPtr epCPtr rva) (?G'2865 (from_bool isBlocking) thread epCPtr epCPtr rva rv' ret__unsigned) [catchbrk_C, SKIP] (capFaultOnFailure epCPtr True (case rva of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread rva isBlocking
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0) >>= case_sum (handleFault thread) return) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI)
 2. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 3. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>?Q2154 isBlockinga thread rv epCPtr\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'2865 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 5. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 7. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (7 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (lookupCap_ret_C.cap_C rv')\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2154 (from_bool isBlocking) thread epCPtr epCPtr rva) (?G'2865 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (capFaultOnFailure epCPtr True (case rva of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread rva isBlocking
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0) >>= case_sum (handleFault thread) return) (IF isEndpointCap rva THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF isNotificationCap rva THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI)
 2. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 3. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>?Q2154 isBlockinga thread rv epCPtr\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'2865 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 5. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 7. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (7 subgoals):
 1. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2154 (from_bool isBlocking) thread epCPtr epCPtr rva) (?G'2865 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isEndpointCap rva then capFaultOnFailure epCPtr True (case capEPCanReceive rva of True \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread rva isBlocking
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0) >>= case_sum (handleFault thread) return else if isNotificationCap rva then capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0) >>= case_sum (handleFault thread) return else capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0)) >>= case_sum (handleFault thread) return) (Cond (if isEndpointCap rva then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))))
 2. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 3. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>?Q2154 isBlockinga thread rv epCPtr\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'2865 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 5. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 7. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (9 subgoals):
 1. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<and> True \<longrightarrow> isEndpointCap rva = (s' \<in> (if isEndpointCap rva then UNIV else {}))
 2. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3211 (from_bool isBlocking) thread epCPtr epCPtr rva) (?R'3208 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (case capEPCanReceive rva of True \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread rva isBlocking
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))
 3. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 4. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ?R3211 isBlockinga thread rv epCPtr a s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?R'3208 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 9. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (8 subgoals):
 1. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3211 (from_bool isBlocking) thread epCPtr epCPtr rva) (?R'3208 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (case capEPCanReceive rva of True \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread rva isBlocking
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))
 2. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 3. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ?R3211 isBlockinga thread rv epCPtr a s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?R'3208 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 8. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (8 subgoals):
 1. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3211 (from_bool isBlocking) thread epCPtr epCPtr rva) (?R'3208 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (case capEPCanReceive rva of True \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread rva isBlocking
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
(CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))))
 2. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 3. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ?R3211 isBlockinga thread rv epCPtr a s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?R'3208 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 8. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (8 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3211 (from_bool isBlocking) thread epCPtr epCPtr rva) (?G'3231 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) ret__unsigned) [catchbrk_C, SKIP] (capFaultOnFailure epCPtr True (case capEPCanReceive rva of True \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread rva isBlocking
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0) >>= case_sum (handleFault thread) return) (IF ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
(CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)))
 2. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 3. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ?R3211 isBlockinga thread rv epCPtr a s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> ?G'3231 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 8. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (8 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3211 (from_bool isBlocking) thread epCPtr epCPtr rva) (?G'3231 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) [catchbrk_C, SKIP] (if capEPCanReceive rva then liftE (do y <- deleteCallerCap thread;
receiveIPC thread rva isBlocking
od) >>= case_sum (handleFault thread) return else capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0)) >>= case_sum (handleFault thread) return) (Cond (if capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')) = 0 then UNIV else {}) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C) SKIP;;
(CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)))
 2. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 3. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ?R3211 isBlockinga thread rv epCPtr a s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> ?G'3231 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 8. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (11 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<and> True \<longrightarrow> (\<not> capEPCanReceive rva) = (s' \<in> (if capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')) = 0 then UNIV else {}))
 2. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3424 (from_bool isBlocking) thread epCPtr epCPtr rva) (?R'3420 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C)
 3. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3422 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3416 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) [catchbrk_C, SKIP] (do a <- liftE (do y <- deleteCallerCap thread;
receiveIPC thread rva isBlocking
od);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))
 4. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'3418 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 5. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 6. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 7. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ?R3424 isBlockinga thread rv epCPtr a s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ?U3422 isBlockinga thread rv epCPtr a s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 8. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> ?R'3420 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va \<inter> ?PT'3418 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va) \<and> (sa \<notin> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> ?U'3416 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 9. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 10. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rva rv' s s'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<not> capEPCanReceive rva) = (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')) = 0)
 2. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3424 (from_bool isBlocking) thread epCPtr epCPtr rva) (?R'3420 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C)
 3. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3422 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3416 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) [catchbrk_C, SKIP] (do a <- liftE (do y <- deleteCallerCap thread;
receiveIPC thread rva isBlocking
od);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))
 4. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'3418 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 5. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 6. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 7. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ?R3424 isBlockinga thread rv epCPtr a s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ?U3422 isBlockinga thread rv epCPtr a s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 8. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> ?R'3420 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va \<inter> ?PT'3418 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va) \<and> (sa \<notin> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> ?U'3416 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 9. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 10. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rva rv' s s'. \<lbrakk>ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))) (capEPBadge_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))))) (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rva = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))) (capEPBadge_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))); (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<not> to_bool (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) = (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')) = 0)
 2. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3424 (from_bool isBlocking) thread epCPtr epCPtr rva) (?R'3420 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C)
 3. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3422 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3416 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) [catchbrk_C, SKIP] (do a <- liftE (do y <- deleteCallerCap thread;
receiveIPC thread rva isBlocking
od);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))
 4. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'3418 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 5. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 6. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 7. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ?R3424 isBlockinga thread rv epCPtr a s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ?U3422 isBlockinga thread rv epCPtr a s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 8. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> ?R'3420 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va \<inter> ?PT'3418 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va) \<and> (sa \<notin> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> ?U'3416 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 9. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 10. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3424 (from_bool isBlocking) thread epCPtr epCPtr rva) (?R'3420 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C)
 2. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3422 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3416 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) [catchbrk_C, SKIP] (do a <- liftE (do y <- deleteCallerCap thread;
receiveIPC thread rva isBlocking
od);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))
 3. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'3418 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 4. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 5. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ?R3424 isBlockinga thread rv epCPtr a s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ?U3422 isBlockinga thread rv epCPtr a s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 7. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> ?R'3420 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va \<inter> ?PT'3418 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va) \<and> (sa \<notin> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> ?U'3416 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 9. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 10. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (10 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3424 (from_bool isBlocking) thread epCPtr epCPtr rva) (?R'3420 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
(\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
(CALL handleFault_'proc(\<acute>ksCurThread);;
break_C)))
 2. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3422 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3416 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) [catchbrk_C, SKIP] (do a <- liftE (do y <- deleteCallerCap thread;
receiveIPC thread rva isBlocking
od);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))
 3. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'3418 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 4. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 5. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ?R3424 isBlockinga thread rv epCPtr a s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ?U3422 isBlockinga thread rv epCPtr a s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 7. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> ?R'3420 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va \<inter> ?PT'3418 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va) \<and> (sa \<notin> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> ?U'3416 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 9. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 10. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (10 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3424 (from_bool isBlocking) thread epCPtr epCPtr rva) (?R'3420 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) [catchbrk_C, SKIP] (handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
(\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
(CALL handleFault_'proc(\<acute>ksCurThread);;
break_C)))
 2. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3422 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3416 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) [catchbrk_C, SKIP] (do a <- liftE (do y <- deleteCallerCap thread;
receiveIPC thread rva isBlocking
od);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))
 3. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'3418 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 4. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 5. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ?R3424 isBlockinga thread rv epCPtr a s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ?U3422 isBlockinga thread rv epCPtr a s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 7. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> ?R'3420 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va \<inter> ?PT'3418 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va) \<and> (sa \<notin> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> ?U'3416 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 9. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 10. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (10 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'3449 (from_bool isBlocking) thread epCPtr epCPtr rva) (?Q3447 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) [catchbrk_C, SKIP] (handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
(\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
(CALL handleFault_'proc(\<acute>ksCurThread);;
break_C)))
 2. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3422 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3416 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) [catchbrk_C, SKIP] (do a <- liftE (do y <- deleteCallerCap thread;
receiveIPC thread rva isBlocking
od);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))
 3. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'3418 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 4. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 5. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ?P'3449 isBlockinga thread rv epCPtr a) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ?U3422 isBlockinga thread rv epCPtr a s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 7. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q3447 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va} \<inter> ?PT'3418 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va) \<and> (sa \<notin> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> ?U'3416 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 9. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 10. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (12 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'3449 (from_bool isBlocking) thread epCPtr epCPtr rva) (?Q'3452 thread epCPtr rva rv' ret__unsigned) [catchbrk_C, SKIP] (handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
(CALL handleFault_'proc(\<acute>ksCurThread);;
break_C))
 2. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3447 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) (?Q'3452 thread epCPtr rva rv' ret__unsigned)
 3. \<And>thread epCPtr rva rv' ret__unsigned s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; ?P'3449 (from_bool isBlocking) thread epCPtr epCPtr rva s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3447 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 4. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3422 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3416 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) [catchbrk_C, SKIP] (do a <- liftE (do y <- deleteCallerCap thread;
receiveIPC thread rva isBlocking
od);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))
 5. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'3418 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 6. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 7. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 8. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ?P'3449 isBlockinga thread rv epCPtr a) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ?U3422 isBlockinga thread rv epCPtr a s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 9. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q3447 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va} \<inter> ?PT'3418 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va) \<and> (sa \<notin> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> ?U'3416 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 10. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'3460 (from_bool isBlocking) thread epCPtr epCPtr rva) (?Q3458 thread epCPtr rva rv' ret__unsigned) [catchbrk_C, SKIP] (handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
(CALL handleFault_'proc(\<acute>ksCurThread);;
break_C))
 2. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3447 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q3458 thread epCPtr rva rv' ret__unsigned}
 3. \<And>thread epCPtr rva rv' ret__unsigned s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; ((\<lambda>_. True) and ?P'3460 (from_bool isBlocking) thread epCPtr epCPtr rva) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3447 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 4. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3422 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3416 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) [catchbrk_C, SKIP] (do a <- liftE (do y <- deleteCallerCap thread;
receiveIPC thread rva isBlocking
od);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))
 5. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'3418 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 6. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 7. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 8. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and ?P'3460 isBlockinga thread rv epCPtr a)) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ?U3422 isBlockinga thread rv epCPtr a s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 9. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q3447 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va} \<inter> ?PT'3418 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va) \<and> (sa \<notin> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> ?U'3416 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 10. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'3460 (from_bool isBlocking) thread epCPtr epCPtr rva) (?Q'3463 thread epCPtr rva rv' ret__unsigned) [catchbrk_C, SKIP] (handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (CALL handleFault_'proc(\<acute>ksCurThread);;
break_C)
 2. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3458 thread epCPtr rva rv' ret__unsigned) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) (?Q'3463 thread epCPtr rva rv' ret__unsigned)
 3. \<And>thread epCPtr rva rv' ret__unsigned s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; ?P'3460 (from_bool isBlocking) thread epCPtr epCPtr rva s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3458 thread epCPtr rva rv' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 4. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3447 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q3458 thread epCPtr rva rv' ret__unsigned}
 5. \<And>thread epCPtr rva rv' ret__unsigned s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; ((\<lambda>_. True) and ?P'3460 (from_bool isBlocking) thread epCPtr epCPtr rva) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3447 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 6. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3422 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3416 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) [catchbrk_C, SKIP] (do a <- liftE (do y <- deleteCallerCap thread;
receiveIPC thread rva isBlocking
od);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))
 7. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'3418 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 8. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 9. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 10. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and ?P'3460 isBlockinga thread rv epCPtr a)) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ?U3422 isBlockinga thread rv epCPtr a s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'3460 (from_bool isBlocking) thread epCPtr epCPtr rva) (?Q'3463 thread epCPtr rva rv' ret__unsigned) [catchbrk_C, SKIP] (handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0)) >>= return) (CALL handleFault_'proc(\<acute>ksCurThread);;
break_C)
 2. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3458 thread epCPtr rva rv' ret__unsigned) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) (?Q'3463 thread epCPtr rva rv' ret__unsigned)
 3. \<And>thread epCPtr rva rv' ret__unsigned s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; ?P'3460 (from_bool isBlocking) thread epCPtr epCPtr rva s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3458 thread epCPtr rva rv' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 4. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3447 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q3458 thread epCPtr rva rv' ret__unsigned}
 5. \<And>thread epCPtr rva rv' ret__unsigned s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; ((\<lambda>_. True) and ?P'3460 (from_bool isBlocking) thread epCPtr epCPtr rva) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3447 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 6. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3422 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3416 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) [catchbrk_C, SKIP] (do a <- liftE (do y <- deleteCallerCap thread;
receiveIPC thread rva isBlocking
od);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))
 7. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'3418 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 8. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 9. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 10. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and ?P'3460 isBlockinga thread rv epCPtr a)) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ?U3422 isBlockinga thread rv epCPtr a s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
A total of 14 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres (?r'3471 thread epCPtr rva rv' ret__unsigned) (?xf''3471 thread epCPtr rva rv' ret__unsigned) (?P3476 (from_bool isBlocking) thread epCPtr epCPtr rva) (?C'3471 thread epCPtr rva rv' ret__unsigned) [] (handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (Call handleFault_'proc)
 2. \<And>thread epCPtr rva rv' ret__unsigned s ta sa. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> globals sa = globals sa
 3. \<And>thread epCPtr rva rv' ret__unsigned a s t. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> xfdc (s\<lparr>globals := globals t\<rparr>) = ?xf''3471 thread epCPtr rva rv' ret__unsigned t
 4. \<And>thread epCPtr rva rv' ret__unsigned s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> globals (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) = globals s
 5. \<And>thread epCPtr rva rv' ret__unsigned rv'a t t'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' break_C break_C
 6. \<And>thread epCPtr rva rv' ret__unsigned x rv'a. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; ?r'3471 thread epCPtr rva rv' ret__unsigned x rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) UNIV [catchbrk_C, SKIP] (return x) break_C
 7. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<lbrace>?R3474 (from_bool isBlocking) thread epCPtr epCPtr rva\<rbrace> handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0)) \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3471 thread epCPtr rva rv' ret__unsigned\<^esub> (?R'3471 thread epCPtr rva rv' ret__unsigned) CALL handleFault_'proc(\<acute>ksCurThread) {s. \<forall>x. ?r'3471 thread epCPtr rva rv' ret__unsigned x (xfdc s) \<longrightarrow> s \<in> UNIV}
 9. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3458 thread epCPtr rva rv' ret__unsigned) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> ?C'3471 thread epCPtr rva rv' ret__unsigned} \<inter> ?R'3471 thread epCPtr rva rv' ret__unsigned)
 10. \<And>thread epCPtr rva rv' ret__unsigned s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; (?P3476 (from_bool isBlocking) thread epCPtr epCPtr rva and ?R3474 (from_bool isBlocking) thread epCPtr epCPtr rva) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3458 thread epCPtr rva rv' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned s ta sa. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> globals sa = globals sa
 2. \<And>thread epCPtr rva rv' ret__unsigned a s t. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> xfdc (s\<lparr>globals := globals t\<rparr>) = xfdc t
 3. \<And>thread epCPtr rva rv' ret__unsigned s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> globals (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) = globals s
 4. \<And>thread epCPtr rva rv' ret__unsigned rv'a t t'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' break_C break_C
 5. \<And>thread epCPtr rva rv' ret__unsigned x rv'a. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; dc x rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) UNIV [catchbrk_C, SKIP] (return x) break_C
 6. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<lbrace>?R3474 (from_bool isBlocking) thread epCPtr epCPtr rva\<rbrace> handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0)) \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3471 thread epCPtr rva rv' ret__unsigned\<^esub> (?R'3471 thread epCPtr rva rv' ret__unsigned) CALL handleFault_'proc(\<acute>ksCurThread) {s. \<forall>x. dc x (xfdc s) \<longrightarrow> s \<in> UNIV}
 8. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3458 thread epCPtr rva rv' ret__unsigned) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'3471 thread epCPtr rva rv' ret__unsigned)
 9. \<And>thread epCPtr rva rv' ret__unsigned s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R3474 (from_bool isBlocking) thread epCPtr epCPtr rva) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3458 thread epCPtr rva rv' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 10. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3447 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q3458 thread epCPtr rva rv' ret__unsigned}
A total of 20 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>rva rv' ret__unsigned rv'a t t'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' break_C break_C
 2. \<And>thread epCPtr rva rv' ret__unsigned x rv'a. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; dc x rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) UNIV [catchbrk_C, SKIP] (return x) break_C
 3. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<lbrace>?R3474 (from_bool isBlocking) thread epCPtr epCPtr rva\<rbrace> handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0)) \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3471 thread epCPtr rva rv' ret__unsigned\<^esub> (?R'3471 thread epCPtr rva rv' ret__unsigned) CALL handleFault_'proc(\<acute>ksCurThread) {s. \<forall>x. dc x (xfdc s) \<longrightarrow> s \<in> UNIV}
 5. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3458 thread epCPtr rva rv' ret__unsigned) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'3471 thread epCPtr rva rv' ret__unsigned)
 6. \<And>thread epCPtr rva rv' ret__unsigned s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R3474 (from_bool isBlocking) thread epCPtr epCPtr rva) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3458 thread epCPtr rva rv' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 7. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3447 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q3458 thread epCPtr rva rv' ret__unsigned}
 8. \<And>thread epCPtr rva rv' ret__unsigned s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R3474 (from_bool isBlocking) thread epCPtr epCPtr rva)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3447 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 9. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3422 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3416 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) [catchbrk_C, SKIP] (do a <- liftE (do y <- deleteCallerCap thread;
receiveIPC thread rva isBlocking
od);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))
 10. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'3418 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned x rv'a. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; dc x rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) UNIV [catchbrk_C, SKIP] (return x) break_C
 2. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<lbrace>?R3474 (from_bool isBlocking) thread epCPtr epCPtr rva\<rbrace> handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0)) \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3471 thread epCPtr rva rv' ret__unsigned\<^esub> (?R'3471 thread epCPtr rva rv' ret__unsigned) CALL handleFault_'proc(\<acute>ksCurThread) {s. \<forall>x. dc x (xfdc s) \<longrightarrow> s \<in> UNIV}
 4. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3458 thread epCPtr rva rv' ret__unsigned) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'3471 thread epCPtr rva rv' ret__unsigned)
 5. \<And>thread epCPtr rva rv' ret__unsigned s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R3474 (from_bool isBlocking) thread epCPtr epCPtr rva) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3458 thread epCPtr rva rv' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 6. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3447 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q3458 thread epCPtr rva rv' ret__unsigned}
 7. \<And>thread epCPtr rva rv' ret__unsigned s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R3474 (from_bool isBlocking) thread epCPtr epCPtr rva)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3447 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 8. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3422 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3416 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) [catchbrk_C, SKIP] (do a <- liftE (do y <- deleteCallerCap thread;
receiveIPC thread rva isBlocking
od);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))
 9. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'3418 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 10. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
A total of 16 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned x rv'a s s'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; dc x rv'a; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> dc x (xfdc s')
 2. \<And>thread epCPtr rva rv' ret__unsigned x rv'a s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; dc x rv'a\<rbrakk> \<Longrightarrow> xfdc (s\<lparr>global_exn_var_' := Break\<rparr>) = xfdc s
 3. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<lbrace>?R3474 (from_bool isBlocking) thread epCPtr epCPtr rva\<rbrace> handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0)) \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3471 thread epCPtr rva rv' ret__unsigned\<^esub> (?R'3471 thread epCPtr rva rv' ret__unsigned) CALL handleFault_'proc(\<acute>ksCurThread) {s. \<forall>x. dc x (xfdc s) \<longrightarrow> s \<in> UNIV}
 5. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3458 thread epCPtr rva rv' ret__unsigned) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'3471 thread epCPtr rva rv' ret__unsigned)
 6. \<And>thread epCPtr rva rv' ret__unsigned s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R3474 (from_bool isBlocking) thread epCPtr epCPtr rva) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3458 thread epCPtr rva rv' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 7. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3447 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q3458 thread epCPtr rva rv' ret__unsigned}
 8. \<And>thread epCPtr rva rv' ret__unsigned s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R3474 (from_bool isBlocking) thread epCPtr epCPtr rva)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3447 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 9. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3422 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3416 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) [catchbrk_C, SKIP] (do a <- liftE (do y <- deleteCallerCap thread;
receiveIPC thread rva isBlocking
od);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))
 10. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'3418 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
A total of 17 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<lbrace>?R3474 (from_bool isBlocking) thread epCPtr epCPtr rva\<rbrace> handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0)) \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3471 thread epCPtr rva rv' ret__unsigned\<^esub> (?R'3471 thread epCPtr rva rv' ret__unsigned) CALL handleFault_'proc(\<acute>ksCurThread) {s. \<forall>x. dc x (xfdc s) \<longrightarrow> s \<in> UNIV}
 3. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3458 thread epCPtr rva rv' ret__unsigned) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'3471 thread epCPtr rva rv' ret__unsigned)
 4. \<And>thread epCPtr rva rv' ret__unsigned s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R3474 (from_bool isBlocking) thread epCPtr epCPtr rva) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3458 thread epCPtr rva rv' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 5. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3447 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q3458 thread epCPtr rva rv' ret__unsigned}
 6. \<And>thread epCPtr rva rv' ret__unsigned s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R3474 (from_bool isBlocking) thread epCPtr epCPtr rva)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3447 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 7. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3422 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3416 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) [catchbrk_C, SKIP] (do a <- liftE (do y <- deleteCallerCap thread;
receiveIPC thread rva isBlocking
od);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))
 8. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'3418 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 9. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 10. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3471 thread epCPtr rva rv' ret__unsigned\<^esub> (?R'3471 thread epCPtr rva rv' ret__unsigned) CALL handleFault_'proc(\<acute>ksCurThread) {s. \<forall>x. dc x (xfdc s) \<longrightarrow> s \<in> UNIV}
 2. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3458 thread epCPtr rva rv' ret__unsigned) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'3471 thread epCPtr rva rv' ret__unsigned)
 3. \<And>thread epCPtr rva rv' ret__unsigned s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3458 thread epCPtr rva rv' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 4. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3447 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q3458 thread epCPtr rva rv' ret__unsigned}
 5. \<And>thread epCPtr rva rv' ret__unsigned s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3447 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 6. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3422 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3416 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) [catchbrk_C, SKIP] (do a <- liftE (do y <- deleteCallerCap thread;
receiveIPC thread rva isBlocking
od);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))
 7. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'3418 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 8. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 9. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 10. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ?U3422 isBlockinga thread rv epCPtr a s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3458 thread epCPtr rva rv' ret__unsigned) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 2. \<And>thread epCPtr rva rv' ret__unsigned s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3458 thread epCPtr rva rv' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 3. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3447 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q3458 thread epCPtr rva rv' ret__unsigned}
 4. \<And>thread epCPtr rva rv' ret__unsigned s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3447 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 5. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3422 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3416 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) [catchbrk_C, SKIP] (do a <- liftE (do y <- deleteCallerCap thread;
receiveIPC thread rva isBlocking
od);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))
 6. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'3418 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 7. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 8. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 9. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ?U3422 isBlockinga thread rv epCPtr a s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 10. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q3447 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va} \<inter> ?PT'3418 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va) \<and> (sa \<notin> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> ?U'3416 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 2. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3447 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> \<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 3. \<And>thread epCPtr rva rv' ret__unsigned s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3447 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 4. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3422 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3416 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) [catchbrk_C, SKIP] (do a <- liftE (do y <- deleteCallerCap thread;
receiveIPC thread rva isBlocking
od);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))
 5. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'3418 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 6. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 7. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 8. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ?U3422 isBlockinga thread rv epCPtr a s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 9. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q3447 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va} \<inter> ?PT'3418 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va) \<and> (sa \<notin> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> ?U'3416 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 10. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. \<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> (s, globals_update (current_fault_'_update (\<lambda>_. ret__struct_seL4_Fault_C_' t)) sa) \<in> rf_sr}
 2. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3447 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> \<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 3. \<And>thread epCPtr rva rv' ret__unsigned s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3447 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 4. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3422 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3416 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) [catchbrk_C, SKIP] (do a <- liftE (do y <- deleteCallerCap thread;
receiveIPC thread rva isBlocking
od);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))
 5. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'3418 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 6. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 7. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 8. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ?U3422 isBlockinga thread rv epCPtr a s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 9. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q3447 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va} \<inter> ?PT'3418 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va) \<and> (sa \<notin> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> ?U'3416 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 10. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3447 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> \<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 2. \<And>thread epCPtr rva rv' ret__unsigned s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3447 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 3. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3422 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3416 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) [catchbrk_C, SKIP] (do a <- liftE (do y <- deleteCallerCap thread;
receiveIPC thread rva isBlocking
od);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))
 4. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'3418 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 5. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 6. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 7. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ?U3422 isBlockinga thread rv epCPtr a s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 8. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q3447 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va} \<inter> ?PT'3418 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va) \<and> (sa \<notin> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> ?U'3416 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 9. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 10. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))} \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 2. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3422 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3416 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) [catchbrk_C, SKIP] (do a <- liftE (do y <- deleteCallerCap thread;
receiveIPC thread rva isBlocking
od);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))
 3. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'3418 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 4. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 5. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ?U3422 isBlockinga thread rv epCPtr a s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 7. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> ?PT'3418 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va) \<and> (sa \<notin> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> ?U'3416 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 9. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 10. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (10 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); \<not> capEPCanReceive rva; ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) s\<rbrakk> \<Longrightarrow> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))} \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (s, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) sa) \<in> rf_sr}
 2. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3422 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3416 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) [catchbrk_C, SKIP] (do a <- liftE (do y <- deleteCallerCap thread;
receiveIPC thread rva isBlocking
od);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))
 3. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'3418 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 4. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 5. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ?U3422 isBlockinga thread rv epCPtr a s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 7. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> ?PT'3418 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va) \<and> (sa \<notin> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> ?U'3416 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 9. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 10. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (9 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3422 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3416 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) [catchbrk_C, SKIP] (do a <- liftE (do y <- deleteCallerCap thread;
receiveIPC thread rva isBlocking
od);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))
 2. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'3418 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 3. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 4. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ?U3422 isBlockinga thread rv epCPtr a s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> ?PT'3418 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va) \<and> (sa \<notin> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> ?U'3416 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 9. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (9 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3422 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3416 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) [catchbrk_C, SKIP] (do y <- deleteCallerCap thread;
receiveIPC thread rva isBlocking
od) (CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))
 2. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'3418 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 3. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 4. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ?U3422 isBlockinga thread rv epCPtr a s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> ?PT'3418 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va) \<and> (sa \<notin> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> ?U'3416 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 9. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (11 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned rv xfdca. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva; dc rv xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3628 thread epCPtr rva rv' ret__unsigned rv) (?Q'3628 thread epCPtr rva rv' ret__unsigned rv xfdca) [catchbrk_C, SKIP] (receiveIPC thread rva isBlocking) (CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))
 2. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<lbrace>?R3636 (from_bool isBlocking) thread epCPtr epCPtr rva\<rbrace> deleteCallerCap thread \<lbrace>?Q3628 thread epCPtr rva rv' ret__unsigned\<rbrace>
 3. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3629 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) CALL deleteCallerCap_'proc(\<acute>ksCurThread) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'3628 thread epCPtr rva rv' ret__unsigned rv (xfdc s)}
 4. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'3418 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 5. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 6. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 7. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R3636 isBlockinga thread rv epCPtr a) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 8. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> ?PT'3418 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va) \<and> (sa \<notin> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'3629 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 9. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 10. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned rv xfdca. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva; dc rv xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'3672 thread epCPtr rva rv' ret__unsigned rv) (?Q3669 thread epCPtr rva rv' ret__unsigned rv xfdca) [catchbrk_C, SKIP] (receiveIPC thread rva isBlocking) (CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))
 2. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<lbrace>?R3636 (from_bool isBlocking) thread epCPtr epCPtr rva\<rbrace> deleteCallerCap thread \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and ?P'3672 thread epCPtr rva rv' ret__unsigned a\<rbrace>
 3. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3629 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) CALL deleteCallerCap_'proc(\<acute>ksCurThread) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> ?Q3669 thread epCPtr rva rv' ret__unsigned rv (xfdc s)}}
 4. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'3418 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 5. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 6. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 7. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R3636 isBlockinga thread rv epCPtr a) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 8. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> ?PT'3418 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va) \<and> (sa \<notin> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'3629 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 9. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 10. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<lbrace>?R3636 (from_bool isBlocking) thread epCPtr epCPtr rva\<rbrace> deleteCallerCap thread \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and valid_cap' rva and K (isEndpointCap rva))\<rbrace>
 2. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3629 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) CALL deleteCallerCap_'proc(\<acute>ksCurThread) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. isBlocking_'_update (\<lambda>_. from_bool isBlocking) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C rv') (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rva \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool isBlocking\<rbrace>}}}
 3. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'3418 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 4. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 5. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R3636 isBlockinga thread rv epCPtr a) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 7. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> ?PT'3418 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va) \<and> (sa \<notin> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'3629 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 9. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 10. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (9 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3629 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) CALL deleteCallerCap_'proc(\<acute>ksCurThread) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. isBlocking_'_update (\<lambda>_. from_bool isBlocking) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C rv') (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rva \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool isBlocking\<rbrace>}}}
 2. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'3418 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 3. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 4. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> ?PT'3418 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va) \<and> (sa \<notin> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'3629 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 9. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (10 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> UNIV \<subseteq> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksCurThread s = thread \<longrightarrow> s' \<in> {s. isBlocking_'_update (\<lambda>_. from_bool isBlocking) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C rv') (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rva \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool isBlocking\<rbrace>}}}
 2. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> {} \<subseteq> {}
 3. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'3418 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 4. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 5. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 7. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> ?PT'3418 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va) \<and> (sa \<notin> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 9. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 10. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (9 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')); capEPCanReceive rva\<rbrakk> \<Longrightarrow> {} \<subseteq> {}
 2. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'3418 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 3. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 4. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> ?PT'3418 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va) \<and> (sa \<notin> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 9. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (8 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva; ret__unsigned = capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'3418 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 2. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 3. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> ?PT'3418 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va) \<and> (sa \<notin> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 8. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (8 subgoals):
 1. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'3418 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C rv')))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 2. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 3. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> ?PT'3418 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va) \<and> (sa \<notin> (if va = 0 then UNIV else {}) \<longrightarrow> sa \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 8. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (7 subgoals):
 1. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then do a <- capFaultOnFailure epCPtr True (case capNtfnCanReceive rva of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification (capNtfnPtr rva);
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread rva isBlocking else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 2. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 3. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 5. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 7. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (7 subgoals):
 1. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then if capNtfnCanReceive rva then doE rv <- liftE (getNotification (capNtfnPtr rva));
capFaultOnFailure epCPtr True (if ntfnBoundTCB rv = Some thread \<or> ntfnBoundTCB rv = None then liftE (receiveSignal thread rva isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0))
odE >>= case_sum (handleFault thread) return else capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0)) >>= case_sum (handleFault thread) return else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 2. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 3. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 5. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 7. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (7 subgoals):
 1. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3209 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3207 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if isNotificationCap rva then if capNtfnCanReceive rva then do rv <- getNotification (capNtfnPtr rva);
y <- capFaultOnFailure epCPtr True (if ntfnBoundTCB rv = Some thread \<or> ntfnBoundTCB rv = None then liftE (receiveSignal thread rva isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0));
case y of Inl x \<Rightarrow> handleFault thread x | Inr x \<Rightarrow> return x
od else capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0)) >>= case_sum (handleFault thread) return else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (Cond (if isNotificationCap rva then UNIV else {}) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 2. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 3. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ?U3209 isBlockinga thread rv epCPtr a s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3207 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 5. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 7. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (9 subgoals):
 1. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<and> True \<longrightarrow> isNotificationCap rva = (s' \<in> (if isNotificationCap rva then UNIV else {}))
 2. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3882 (from_bool isBlocking) thread epCPtr epCPtr rva) (?R'3879 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if capNtfnCanReceive rva then do rv <- getNotification (capNtfnPtr rva);
y <- capFaultOnFailure epCPtr True (if ntfnBoundTCB rv = Some thread \<or> ntfnBoundTCB rv = None then liftE (receiveSignal thread rva isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0));
case y of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))
 3. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 4. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> ?R3882 isBlockinga thread rv epCPtr a s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?R'3879 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 9. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (8 subgoals):
 1. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3882 (from_bool isBlocking) thread epCPtr epCPtr rva) (?R'3879 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if capNtfnCanReceive rva then do rv <- getNotification (capNtfnPtr rva);
y <- capFaultOnFailure epCPtr True (if ntfnBoundTCB rv = Some thread \<or> ntfnBoundTCB rv = None then liftE (receiveSignal thread rva isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0));
case y of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))
 2. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 3. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> ?R3882 isBlockinga thread rv epCPtr a s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?R'3879 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 8. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (8 subgoals):
 1. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3882 (from_bool isBlocking) thread epCPtr epCPtr rva) (?R'3879 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if capNtfnCanReceive rva then do rv <- getNotification (capNtfnPtr rva);
y <- capFaultOnFailure epCPtr True (if ntfnBoundTCB rv = Some thread \<or> ntfnBoundTCB rv = None then liftE (receiveSignal thread rva isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0));
case y of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
(lvar_nondet_init boundTCB_' boundTCB_'_update;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
(\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
(\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)))))))))
 2. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 3. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> ?R3882 isBlockinga thread rv epCPtr a s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?R'3879 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 8. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (8 subgoals):
 1. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3882 (from_bool isBlocking) thread epCPtr epCPtr rva) (?G'3914 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if capNtfnCanReceive rva then do rv <- getNotification (capNtfnPtr rva);
y <- capFaultOnFailure epCPtr True (if ntfnBoundTCB rv = Some thread \<or> ntfnBoundTCB rv = None then liftE (receiveSignal thread rva isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0));
case y of Inl x \<Rightarrow> handleFault thread x | Inr x \<Rightarrow> return x
od else capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0)) >>= case_sum (handleFault thread) return) (lvar_nondet_init boundTCB_' boundTCB_'_update;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
(\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
(\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))))))))
 2. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 3. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> ?R3882 isBlockinga thread rv epCPtr a s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> ?G'3914 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 8. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (8 subgoals):
 1. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3882 (from_bool isBlocking) thread epCPtr epCPtr rva) (?G'3930 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (if capNtfnCanReceive rva then do rv <- getNotification (capNtfnPtr rva);
y <- capFaultOnFailure epCPtr True (if ntfnBoundTCB rv = Some thread \<or> ntfnBoundTCB rv = None then liftE (receiveSignal thread rva isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0));
case y of Inl x \<Rightarrow> handleFault thread x | Inr x \<Rightarrow> return x
od else capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0)) >>= case_sum (handleFault thread) return) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
(\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
(\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)))))))
 2. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 3. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> ?R3882 isBlockinga thread rv epCPtr a s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> ?G'3930 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 8. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (8 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; isNotificationCap rva; ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3882 (from_bool isBlocking) thread epCPtr epCPtr rva) (?G'3949 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) ret__unsigned) [catchbrk_C, SKIP] (if capNtfnCanReceive rva then do rv <- getNotification (capNtfnPtr rva);
y <- capFaultOnFailure epCPtr True (if ntfnBoundTCB rv = Some thread \<or> ntfnBoundTCB rv = None then liftE (receiveSignal thread rva isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0));
case y of Inl x \<Rightarrow> handleFault thread x | Inr x \<Rightarrow> return x
od else capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0)) >>= case_sum (handleFault thread) return) (\<acute>ntfnPtr :== ntfn_Ptr ret__unsigned;;
(\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
(\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking))))))
 2. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 3. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> ?R3882 isBlockinga thread rv epCPtr a s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> ?G'3949 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 8. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (8 subgoals):
 1. \<And>thread epCPtr rva rv' ret__unsigned. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; isNotificationCap rva; ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rv'))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3882 (from_bool isBlocking) thread epCPtr epCPtr rva) (?G'4052 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) ret__unsigned) [catchbrk_C, SKIP] (if capNtfnCanReceive rva then do rv <- getNotification (capNtfnPtr rva);
y <- capFaultOnFailure epCPtr True (if ntfnBoundTCB rv = Some thread \<or> ntfnBoundTCB rv = None then liftE (receiveSignal thread rva isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0));
case y of Inl x \<Rightarrow> handleFault thread x | Inr x \<Rightarrow> return x
od else capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0)) >>= case_sum (handleFault thread) return) (\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfn_Ptr ret__unsigned);;
(\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)))))
 2. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 3. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> ?R3882 isBlockinga thread rv epCPtr a s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> ?G'4052 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 8. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (8 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R3882 (from_bool isBlocking) thread epCPtr epCPtr rv) (?G'4052 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) ntfnptr) [catchbrk_C, SKIP] (if capNtfnCanReceive rv then do rva <- getNotification (capNtfnPtr rv);
y <- capFaultOnFailure epCPtr True (if ntfnBoundTCB rva = Some thread \<or> ntfnBoundTCB rva = None then liftE (receiveSignal thread rv isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0));
case y of Inl x \<Rightarrow> handleFault thread x | Inr x \<Rightarrow> return x
od else capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0)) >>= case_sum (handleFault thread) return) (\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfn_Ptr ntfnptr);;
(\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rva);;
(IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking)))))
 2. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 3. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> ?R3882 isBlockinga thread rv epCPtr a s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> ?G'4052 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 8. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (8 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'4273 (from_bool isBlocking) thread epCPtr epCPtr rv) (?Q4272 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) ntfnptr) [catchbrk_C, SKIP] (if capNtfnCanReceive rv then do rva <- getNotification (capNtfnPtr rv);
y <- capFaultOnFailure epCPtr True (if ntfnBoundTCB rva = Some thread \<or> ntfnBoundTCB rva = None then liftE (receiveSignal thread rv isBlocking) else throwError (Fault_H.lookup_failure.MissingCapability 0));
case y of Inl x \<Rightarrow> handleFault thread x | Inr x \<Rightarrow> return x
od else capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0)) >>= case_sum (handleFault thread) return) (\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfn_Ptr ntfnptr);;
(\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rva);;
(IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking)))))
 2. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 3. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and ?P'4273 isBlockinga thread rv epCPtr a) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> ?Q4272 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 8. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (8 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'4273 (from_bool isBlocking) thread epCPtr epCPtr rv) (?Q4272 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)))) [catchbrk_C, SKIP] (if capNtfnCanReceive rv then do rva <- getNotification (capNtfnPtr rv);
if ntfnBoundTCB rva = Some thread \<or> ntfnBoundTCB rva = None then liftE (receiveSignal thread rv isBlocking) >>= case_sum (handleFault thread) return else throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0)) >>= case_sum (handleFault thread) return
od else throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0)) >>= case_sum (handleFault thread) return) (\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))));;
(\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rva);;
(IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking)))))
 2. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 3. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and ?P'4273 isBlockinga thread rv epCPtr a) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> ?Q4272 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 8. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (8 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'4273 (from_bool isBlocking) thread epCPtr epCPtr rv) (?G'4288 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigned \<inter> {s. ret__unsigned = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)))))))}) [catchbrk_C, SKIP] (if capNtfnCanReceive rv then do rva <- getNotification (capNtfnPtr rv);
if ntfnBoundTCB rva = Some thread \<or> ntfnBoundTCB rva = None then liftE (receiveSignal thread rv isBlocking) >>= case_sum (handleFault thread) return else throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0)) >>= case_sum (handleFault thread) return
od else throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0)) >>= case_sum (handleFault thread) return) (\<acute>boundTCB :== tcb_Ptr ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rva);;
(IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))))
 2. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 3. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and ?P'4273 isBlockinga thread rv epCPtr a) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> ?G'4288 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 8. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (8 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'4273 (from_bool isBlocking) thread epCPtr epCPtr rv) (?G'4378 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigned) [catchbrk_C, SKIP] (if capNtfnCanReceive rv then do rva <- getNotification (capNtfnPtr rv);
if ntfnBoundTCB rva = Some thread \<or> ntfnBoundTCB rva = None then liftE (receiveSignal thread rv isBlocking) >>= case_sum (handleFault thread) return else throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0)) >>= case_sum (handleFault thread) return
od else throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0)) >>= case_sum (handleFault thread) return) (\<acute>boundTCB :== tcb_Ptr ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rva);;
(IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))))
 2. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 3. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and ?P'4273 isBlockinga thread rv epCPtr a) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> ?G'4378 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 8. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (8 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'4273 (from_bool isBlocking) thread epCPtr epCPtr rv) (?G'4389 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigned) [catchbrk_C, SKIP] (if capNtfnCanReceive rv then do rva <- getNotification (capNtfnPtr rv);
if ntfnBoundTCB rva = Some thread \<or> ntfnBoundTCB rva = None then liftE (receiveSignal thread rv isBlocking) >>= case_sum (handleFault thread) return else throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0)) >>= case_sum (handleFault thread) return
od else throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0)) >>= case_sum (handleFault thread) return) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rva);;
(IF \<acute>ret__unsigned = 0 \<or> tcb_Ptr ret__unsigned \<noteq> NULL \<and> tcb_Ptr ret__unsigned \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking)))
 2. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 3. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and ?P'4273 isBlockinga thread rv epCPtr a) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> ?G'4389 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 8. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (8 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'4273 (from_bool isBlocking) thread epCPtr epCPtr rv) (?G'4573 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (if capNtfnCanReceive rv then do rva <- getNotification (capNtfnPtr rv);
if ntfnBoundTCB rva = Some thread \<or> ntfnBoundTCB rva = None then liftE (receiveSignal thread rv isBlocking) >>= case_sum (handleFault thread) return else throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0)) >>= case_sum (handleFault thread) return
od else throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0)) >>= case_sum (handleFault thread) return) (IF ret__unsigned = 0 \<or> tcb_Ptr ret__unsigneda \<noteq> NULL \<and> tcb_Ptr ret__unsigneda \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 2. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 3. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and ?P'4273 isBlockinga thread rv epCPtr a) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> ?G'4573 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 8. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (9 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4730 (from_bool isBlocking) thread epCPtr epCPtr rv) (?S4733 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (do rva <- getNotification (capNtfnPtr rv);
if ntfnBoundTCB rva = Some thread \<or> ntfnBoundTCB rva = None then do a <- liftE (receiveSignal thread rv isBlocking);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od
od) (IF ret__unsigned = 0 \<or> tcb_Ptr ret__unsigneda \<noteq> NULL \<and> tcb_Ptr ret__unsigneda \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4729 (from_bool isBlocking) thread epCPtr epCPtr rv) (?T4731 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (IF ret__unsigned = 0 \<or> tcb_Ptr ret__unsigneda \<noteq> NULL \<and> tcb_Ptr ret__unsigneda \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 3. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 4. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> ?Q4730 isBlockinga thread rv epCPtr a b) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ?R4729 isBlockinga thread rv epCPtr a b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> ?S4733 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> ?T4731 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 9. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (9 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned rvb. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?P4741 (from_bool isBlocking) thread epCPtr epCPtr rv a rvb) (?P'4742 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned rvb) [catchbrk_C, SKIP] (if ntfnBoundTCB rvb = Some thread \<or> ntfnBoundTCB rvb = None then do a <- liftE (receiveSignal thread rv isBlocking);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (IF ret__unsigned = 0 \<or> tcb_Ptr ret__unsigneda \<noteq> NULL \<and> tcb_Ptr ret__unsigneda \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4729 (from_bool isBlocking) thread epCPtr epCPtr rv) (?T4731 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (IF ret__unsigned = 0 \<or> tcb_Ptr ret__unsigneda \<noteq> NULL \<and> tcb_Ptr ret__unsigneda \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 3. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 4. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ?P4741 isBlockinga thread rv epCPtr a b ntfn)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ?R4729 isBlockinga thread rv epCPtr a b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> ?P'4742 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> ?T4731 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 9. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (9 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?P4741 (from_bool isBlocking) thread epCPtr epCPtr rv a ntfn) (?P'4742 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) [catchbrk_C, SKIP] (if ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None then do a <- liftE (receiveSignal thread rv isBlocking);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od else do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (IF ret__unsigned = 0 \<or> tcb_Ptr ret__unsigneda \<noteq> NULL \<and> tcb_Ptr ret__unsigneda \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4729 (from_bool isBlocking) thread epCPtr epCPtr rv) (?T4731 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (IF ret__unsigned = 0 \<or> tcb_Ptr ret__unsigneda \<noteq> NULL \<and> tcb_Ptr ret__unsigneda \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 3. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 4. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> ?P4741 isBlockinga thread rv epCPtr a b ntfn)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ?R4729 isBlockinga thread rv epCPtr a b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> ?P'4742 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> ?T4731 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 9. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (12 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s)) s \<and> ret__unsigneda = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)) \<longrightarrow> (\<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None)) = (s' \<in> \<lbrace>ret__unsigned = 0 \<or> tcb_Ptr ret__unsigneda \<noteq> NULL \<and> tcb_Ptr ret__unsigneda \<noteq> \<acute>ksCurThread\<rbrace>)
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4760 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?R'4756 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C)
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U4758 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?U'4752 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) [catchbrk_C, SKIP] (do a <- liftE (receiveSignal thread rv isBlocking);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4754 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 5. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4729 (from_bool isBlocking) thread epCPtr epCPtr rv) (?T4731 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (IF ret__unsigned = 0 \<or> tcb_Ptr ret__unsigneda \<noteq> NULL \<and> tcb_Ptr ret__unsigneda \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 6. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 7. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 8. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ?R4760 isBlockinga thread rv epCPtr a ntfn s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> ?U4758 isBlockinga thread rv epCPtr a ntfn s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ?R4729 isBlockinga thread rv epCPtr a b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 9. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> ?R'4756 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn \<inter> ?PT'4754 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> ?U'4752 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn)}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> ?T4731 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 10. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rva ntfn s s'. \<lbrakk>ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) (capNtfnBadge_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)))) True) (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cap_get_tag (lookupCap_ret_C.cap_C rva) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))); (s, s') \<in> rf_sr; valid_ntfn' ntfn s\<rbrakk> \<Longrightarrow> (ntfnBoundTCB ntfn \<noteq> Some (ksCurThread s) \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)) = (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)) = 0 \<or> (\<exists>y. ntfnBoundTCB ntfn = Some y) \<and> option_to_ctcb_ptr (ntfnBoundTCB ntfn) \<noteq> tcb_ptr_to_ctcb_ptr (ksCurThread s))
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4760 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?R'4756 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C)
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U4758 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?U'4752 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) [catchbrk_C, SKIP] (do a <- liftE (receiveSignal thread rv isBlocking);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4754 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 5. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4729 (from_bool isBlocking) thread epCPtr epCPtr rv) (?T4731 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (IF ret__unsigned = 0 \<or> tcb_Ptr ret__unsigneda \<noteq> NULL \<and> tcb_Ptr ret__unsigneda \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 6. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 7. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 8. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ?R4760 isBlockinga thread rv epCPtr a ntfn s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> ?U4758 isBlockinga thread rv epCPtr a ntfn s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ?R4729 isBlockinga thread rv epCPtr a b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 9. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> ?R'4756 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn \<inter> ?PT'4754 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> ?U'4752 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn)}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> ?T4731 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 10. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4760 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?R'4756 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C)
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U4758 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?U'4752 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) [catchbrk_C, SKIP] (do a <- liftE (receiveSignal thread rv isBlocking);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4754 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4729 (from_bool isBlocking) thread epCPtr epCPtr rv) (?T4731 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (IF ret__unsigned = 0 \<or> tcb_Ptr ret__unsigneda \<noteq> NULL \<and> tcb_Ptr ret__unsigneda \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 5. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 6. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 7. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ?R4760 isBlockinga thread rv epCPtr a ntfn s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> ?U4758 isBlockinga thread rv epCPtr a ntfn s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ?R4729 isBlockinga thread rv epCPtr a b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 8. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> ?R'4756 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn \<inter> ?PT'4754 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> ?U'4752 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn)}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> ?T4731 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 9. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 10. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4760 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?R'4756 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
(\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
(CALL handleFault_'proc(\<acute>ksCurThread);;
break_C)))
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U4758 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?U'4752 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) [catchbrk_C, SKIP] (do a <- liftE (receiveSignal thread rv isBlocking);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4754 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4729 (from_bool isBlocking) thread epCPtr epCPtr rv) (?T4731 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (IF ret__unsigned = 0 \<or> tcb_Ptr ret__unsigneda \<noteq> NULL \<and> tcb_Ptr ret__unsigneda \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 5. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 6. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 7. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ?R4760 isBlockinga thread rv epCPtr a ntfn s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> ?U4758 isBlockinga thread rv epCPtr a ntfn s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ?R4729 isBlockinga thread rv epCPtr a b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 8. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> ?R'4756 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn \<inter> ?PT'4754 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> ?U'4752 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn)}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> ?T4731 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 9. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 10. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4760 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?R'4756 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ntfn) [catchbrk_C, SKIP] (handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
(\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
(CALL handleFault_'proc(\<acute>ksCurThread);;
break_C)))
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U4758 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?U'4752 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) [catchbrk_C, SKIP] (do a <- liftE (receiveSignal thread rv isBlocking);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4754 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4729 (from_bool isBlocking) thread epCPtr epCPtr rv) (?T4731 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (IF ret__unsigned = 0 \<or> tcb_Ptr ret__unsigneda \<noteq> NULL \<and> tcb_Ptr ret__unsigneda \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 5. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 6. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 7. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ?R4760 isBlockinga thread rv epCPtr a ntfn s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> ?U4758 isBlockinga thread rv epCPtr a ntfn s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ?R4729 isBlockinga thread rv epCPtr a b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 8. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> ?R'4756 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn \<inter> ?PT'4754 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> ?U'4752 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn)}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> ?T4731 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 9. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 10. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'4822 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?Q4820 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ntfn) [catchbrk_C, SKIP] (handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
(\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
(CALL handleFault_'proc(\<acute>ksCurThread);;
break_C)))
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U4758 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?U'4752 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) [catchbrk_C, SKIP] (do a <- liftE (receiveSignal thread rv isBlocking);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4754 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4729 (from_bool isBlocking) thread epCPtr epCPtr rv) (?T4731 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (IF ret__unsigned = 0 \<or> tcb_Ptr ret__unsigneda \<noteq> NULL \<and> tcb_Ptr ret__unsigneda \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 5. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 6. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 7. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ?P'4822 isBlockinga thread rv epCPtr a ntfn) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> ?U4758 isBlockinga thread rv epCPtr a ntfn s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ?R4729 isBlockinga thread rv epCPtr a b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 8. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q4820 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn} \<inter> ?PT'4754 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> ?U'4752 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn)}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> ?T4731 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 9. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 10. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'4822 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?Q'4825 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn) [catchbrk_C, SKIP] (handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
(CALL handleFault_'proc(\<acute>ksCurThread);;
break_C))
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4820 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) (?Q'4825 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn)
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); ?P'4822 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4820 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ntfn \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U4758 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?U'4752 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) [catchbrk_C, SKIP] (do a <- liftE (receiveSignal thread rv isBlocking);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 5. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4754 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 6. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4729 (from_bool isBlocking) thread epCPtr epCPtr rv) (?T4731 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (IF ret__unsigned = 0 \<or> tcb_Ptr ret__unsigneda \<noteq> NULL \<and> tcb_Ptr ret__unsigneda \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 7. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 8. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 9. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ?P'4822 isBlockinga thread rv epCPtr a ntfn) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> ?U4758 isBlockinga thread rv epCPtr a ntfn s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ?R4729 isBlockinga thread rv epCPtr a b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 10. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q4820 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn} \<inter> ?PT'4754 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> ?U'4752 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn)}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> ?T4731 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'4833 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?Q4831 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn) [catchbrk_C, SKIP] (handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
(CALL handleFault_'proc(\<acute>ksCurThread);;
break_C))
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4820 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q4831 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn}
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); ((\<lambda>_. True) and ?P'4833 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4820 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ntfn \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U4758 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?U'4752 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) [catchbrk_C, SKIP] (do a <- liftE (receiveSignal thread rv isBlocking);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 5. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4754 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 6. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4729 (from_bool isBlocking) thread epCPtr epCPtr rv) (?T4731 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (IF ret__unsigned = 0 \<or> tcb_Ptr ret__unsigneda \<noteq> NULL \<and> tcb_Ptr ret__unsigneda \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 7. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 8. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 9. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and ?P'4833 isBlockinga thread rv epCPtr a ntfn)) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> ?U4758 isBlockinga thread rv epCPtr a ntfn s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ?R4729 isBlockinga thread rv epCPtr a b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 10. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q4820 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn} \<inter> ?PT'4754 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> ?U'4752 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn)}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> ?T4731 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
A total of 13 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'4833 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?Q'4836 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn) [catchbrk_C, SKIP] (handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (CALL handleFault_'proc(\<acute>ksCurThread);;
break_C)
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4831 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) (?Q'4836 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn)
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); ?P'4833 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4831 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4820 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q4831 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn}
 5. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); ((\<lambda>_. True) and ?P'4833 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4820 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ntfn \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 6. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U4758 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?U'4752 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) [catchbrk_C, SKIP] (do a <- liftE (receiveSignal thread rv isBlocking);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 7. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4754 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 8. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4729 (from_bool isBlocking) thread epCPtr epCPtr rv) (?T4731 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (IF ret__unsigned = 0 \<or> tcb_Ptr ret__unsigneda \<noteq> NULL \<and> tcb_Ptr ret__unsigneda \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 9. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 10. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'4833 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?Q'4836 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn) [catchbrk_C, SKIP] (handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0)) >>= return) (CALL handleFault_'proc(\<acute>ksCurThread);;
break_C)
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4831 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) (?Q'4836 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn)
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); ?P'4833 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4831 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4820 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q4831 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn}
 5. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); ((\<lambda>_. True) and ?P'4833 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4820 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ntfn \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 6. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U4758 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?U'4752 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) [catchbrk_C, SKIP] (do a <- liftE (receiveSignal thread rv isBlocking);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 7. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4754 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 8. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4729 (from_bool isBlocking) thread epCPtr epCPtr rv) (?T4731 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (IF ret__unsigned = 0 \<or> tcb_Ptr ret__unsigneda \<noteq> NULL \<and> tcb_Ptr ret__unsigneda \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 9. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 10. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
A total of 15 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> ccorres (?r'4844 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn) (?xf''4844 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn) (?P4849 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?C'4844 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn) [] (handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (Call handleFault_'proc)
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn s ta sa. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> globals sa = globals sa
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn a s t. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> xfdc (s\<lparr>globals := globals t\<rparr>) = ?xf''4844 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn t
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> globals (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) = globals s
 5. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn rv' t t'. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' break_C break_C
 6. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn x rv'. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); ?r'4844 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn x rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) UNIV [catchbrk_C, SKIP] (return x) break_C
 7. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<lbrace>?R4847 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn\<rbrace> handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0)) \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4844 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn\<^esub> (?R'4844 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn) CALL handleFault_'proc(\<acute>ksCurThread) {s. \<forall>x. ?r'4844 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn x (xfdc s) \<longrightarrow> s \<in> UNIV}
 9. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4831 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> ?C'4844 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn} \<inter> ?R'4844 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn)
 10. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); (?P4849 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn and ?R4847 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4831 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
A total of 22 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn s ta sa. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> globals sa = globals sa
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn a s t. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> xfdc (s\<lparr>globals := globals t\<rparr>) = xfdc t
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> globals (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) = globals s
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn rv' t t'. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' break_C break_C
 5. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn x rv'. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); dc x rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) UNIV [catchbrk_C, SKIP] (return x) break_C
 6. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<lbrace>?R4847 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn\<rbrace> handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0)) \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4844 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn\<^esub> (?R'4844 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn) CALL handleFault_'proc(\<acute>ksCurThread) {s. \<forall>x. dc x (xfdc s) \<longrightarrow> s \<in> UNIV}
 8. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4831 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4844 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn)
 9. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R4847 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4831 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 10. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4820 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q4831 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn}
A total of 21 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread rv rva ntfnptr ret__unsigned ntfn rv' t t'. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' break_C break_C
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn x rv'. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); dc x rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) UNIV [catchbrk_C, SKIP] (return x) break_C
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<lbrace>?R4847 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn\<rbrace> handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0)) \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4844 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn\<^esub> (?R'4844 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn) CALL handleFault_'proc(\<acute>ksCurThread) {s. \<forall>x. dc x (xfdc s) \<longrightarrow> s \<in> UNIV}
 5. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4831 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4844 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn)
 6. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R4847 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4831 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 7. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4820 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q4831 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn}
 8. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R4847 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4820 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ntfn \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 9. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U4758 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?U'4752 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) [catchbrk_C, SKIP] (do a <- liftE (receiveSignal thread rv isBlocking);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 10. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4754 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn x rv'. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); dc x rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) UNIV [catchbrk_C, SKIP] (return x) break_C
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<lbrace>?R4847 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn\<rbrace> handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0)) \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4844 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn\<^esub> (?R'4844 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn) CALL handleFault_'proc(\<acute>ksCurThread) {s. \<forall>x. dc x (xfdc s) \<longrightarrow> s \<in> UNIV}
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4831 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4844 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn)
 5. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R4847 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4831 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 6. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4820 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q4831 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn}
 7. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R4847 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4820 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ntfn \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 8. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U4758 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?U'4752 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) [catchbrk_C, SKIP] (do a <- liftE (receiveSignal thread rv isBlocking);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 9. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4754 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 10. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4729 (from_bool isBlocking) thread epCPtr epCPtr rv) (?T4731 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (IF ret__unsigned = 0 \<or> tcb_Ptr ret__unsigneda \<noteq> NULL \<and> tcb_Ptr ret__unsigneda \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
A total of 17 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn x rv' s s'. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); dc x rv'; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> dc x (xfdc s')
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn x rv' s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); dc x rv'\<rbrakk> \<Longrightarrow> xfdc (s\<lparr>global_exn_var_' := Break\<rparr>) = xfdc s
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<lbrace>?R4847 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn\<rbrace> handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0)) \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4844 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn\<^esub> (?R'4844 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn) CALL handleFault_'proc(\<acute>ksCurThread) {s. \<forall>x. dc x (xfdc s) \<longrightarrow> s \<in> UNIV}
 5. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4831 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4844 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn)
 6. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R4847 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4831 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 7. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4820 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q4831 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn}
 8. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R4847 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4820 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ntfn \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 9. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U4758 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?U'4752 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) [catchbrk_C, SKIP] (do a <- liftE (receiveSignal thread rv isBlocking);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 10. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4754 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
A total of 18 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<lbrace>?R4847 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn\<rbrace> handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0)) \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4844 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn\<^esub> (?R'4844 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn) CALL handleFault_'proc(\<acute>ksCurThread) {s. \<forall>x. dc x (xfdc s) \<longrightarrow> s \<in> UNIV}
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4831 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4844 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn)
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R4847 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4831 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 5. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4820 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q4831 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn}
 6. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R4847 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4820 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ntfn \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 7. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U4758 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?U'4752 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) [catchbrk_C, SKIP] (do a <- liftE (receiveSignal thread rv isBlocking);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 8. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4754 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 9. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4729 (from_bool isBlocking) thread epCPtr epCPtr rv) (?T4731 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (IF ret__unsigned = 0 \<or> tcb_Ptr ret__unsigneda \<noteq> NULL \<and> tcb_Ptr ret__unsigneda \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 10. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4844 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn\<^esub> (?R'4844 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn) CALL handleFault_'proc(\<acute>ksCurThread) {s. \<forall>x. dc x (xfdc s) \<longrightarrow> s \<in> UNIV}
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4831 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4844 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn)
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4831 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4820 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q4831 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn}
 5. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4820 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ntfn \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 6. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U4758 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?U'4752 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) [catchbrk_C, SKIP] (do a <- liftE (receiveSignal thread rv isBlocking);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 7. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4754 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 8. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4729 (from_bool isBlocking) thread epCPtr epCPtr rv) (?T4731 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (IF ret__unsigned = 0 \<or> tcb_Ptr ret__unsigneda \<noteq> NULL \<and> tcb_Ptr ret__unsigneda \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 9. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 10. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4831 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4831 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4820 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q4831 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn}
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4820 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ntfn \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 5. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U4758 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?U'4752 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) [catchbrk_C, SKIP] (do a <- liftE (receiveSignal thread rv isBlocking);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 6. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4754 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 7. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4729 (from_bool isBlocking) thread epCPtr epCPtr rv) (?T4731 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (IF ret__unsigned = 0 \<or> tcb_Ptr ret__unsigneda \<noteq> NULL \<and> tcb_Ptr ret__unsigneda \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 8. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 9. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 10. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> ?U4758 isBlockinga thread rv epCPtr a ntfn s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ?R4729 isBlockinga thread rv epCPtr a b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4820 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> \<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4820 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ntfn \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U4758 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?U'4752 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) [catchbrk_C, SKIP] (do a <- liftE (receiveSignal thread rv isBlocking);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 5. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4754 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 6. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4729 (from_bool isBlocking) thread epCPtr epCPtr rv) (?T4731 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (IF ret__unsigned = 0 \<or> tcb_Ptr ret__unsigneda \<noteq> NULL \<and> tcb_Ptr ret__unsigneda \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 7. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 8. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 9. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> ?U4758 isBlockinga thread rv epCPtr a ntfn s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ?R4729 isBlockinga thread rv epCPtr a b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 10. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q4820 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn} \<inter> ?PT'4754 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> ?U'4752 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn)}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> ?T4731 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. \<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> (s, globals_update (current_fault_'_update (\<lambda>_. ret__struct_seL4_Fault_C_' t)) sa) \<in> rf_sr}
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4820 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> \<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4820 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ntfn \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U4758 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?U'4752 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) [catchbrk_C, SKIP] (do a <- liftE (receiveSignal thread rv isBlocking);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 5. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4754 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 6. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4729 (from_bool isBlocking) thread epCPtr epCPtr rv) (?T4731 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (IF ret__unsigned = 0 \<or> tcb_Ptr ret__unsigneda \<noteq> NULL \<and> tcb_Ptr ret__unsigneda \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 7. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 8. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 9. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> ?U4758 isBlockinga thread rv epCPtr a ntfn s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ?R4729 isBlockinga thread rv epCPtr a b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 10. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q4820 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn} \<inter> ?PT'4754 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> ?U'4752 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn)}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> ?T4731 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4820 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> \<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4820 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ntfn \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U4758 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?U'4752 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) [catchbrk_C, SKIP] (do a <- liftE (receiveSignal thread rv isBlocking);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4754 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 5. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4729 (from_bool isBlocking) thread epCPtr epCPtr rv) (?T4731 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (IF ret__unsigned = 0 \<or> tcb_Ptr ret__unsigneda \<noteq> NULL \<and> tcb_Ptr ret__unsigneda \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 6. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 7. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 8. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> ?U4758 isBlockinga thread rv epCPtr a ntfn s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ?R4729 isBlockinga thread rv epCPtr a b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 9. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q4820 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn} \<inter> ?PT'4754 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> ?U'4752 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn)}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> ?T4731 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 10. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))} \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U4758 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?U'4752 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) [catchbrk_C, SKIP] (do a <- liftE (receiveSignal thread rv isBlocking);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4754 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4729 (from_bool isBlocking) thread epCPtr epCPtr rv) (?T4731 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (IF ret__unsigned = 0 \<or> tcb_Ptr ret__unsigneda \<noteq> NULL \<and> tcb_Ptr ret__unsigneda \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 5. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 6. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 7. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> ?U4758 isBlockinga thread rv epCPtr a ntfn s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ?R4729 isBlockinga thread rv epCPtr a b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 8. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> ?PT'4754 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> ?U'4752 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn)}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> ?T4731 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 9. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 10. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y); ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) s\<rbrakk> \<Longrightarrow> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))} \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (s, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) sa) \<in> rf_sr}
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U4758 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?U'4752 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) [catchbrk_C, SKIP] (do a <- liftE (receiveSignal thread rv isBlocking);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4754 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4729 (from_bool isBlocking) thread epCPtr epCPtr rv) (?T4731 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (IF ret__unsigned = 0 \<or> tcb_Ptr ret__unsigneda \<noteq> NULL \<and> tcb_Ptr ret__unsigneda \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 5. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 6. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 7. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> ?U4758 isBlockinga thread rv epCPtr a ntfn s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ?R4729 isBlockinga thread rv epCPtr a b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 8. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> ?PT'4754 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> ?U'4752 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn)}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> ?T4731 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 9. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 10. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U4758 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?U'4752 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) [catchbrk_C, SKIP] (do a <- liftE (receiveSignal thread rv isBlocking);
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4754 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4729 (from_bool isBlocking) thread epCPtr epCPtr rv) (?T4731 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (IF ret__unsigned = 0 \<or> tcb_Ptr ret__unsigneda \<noteq> NULL \<and> tcb_Ptr ret__unsigneda \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 4. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 5. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> ?U4758 isBlockinga thread rv epCPtr a ntfn s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ?R4729 isBlockinga thread rv epCPtr a b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 7. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> ?PT'4754 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> ?U'4752 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn)}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> ?T4731 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 9. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 10. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (10 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv; ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U4758 (from_bool isBlocking) thread epCPtr epCPtr rv ntfn) (?U'4752 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ntfn) [catchbrk_C, SKIP] (receiveSignal thread rv isBlocking) (CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4754 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4729 (from_bool isBlocking) thread epCPtr epCPtr rv) (?T4731 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (IF ret__unsigned = 0 \<or> tcb_Ptr ret__unsigneda \<noteq> NULL \<and> tcb_Ptr ret__unsigneda \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 4. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 5. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> ?U4758 isBlockinga thread rv epCPtr a ntfn s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ?R4729 isBlockinga thread rv epCPtr a b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 7. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> ?PT'4754 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> ?U'4752 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn)}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> ?T4731 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 9. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 10. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (9 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4754 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4729 (from_bool isBlocking) thread epCPtr epCPtr rv) (?T4731 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (IF ret__unsigned = 0 \<or> tcb_Ptr ret__unsigneda \<noteq> NULL \<and> tcb_Ptr ret__unsigneda \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 3. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 4. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ?R4729 isBlockinga thread rv epCPtr a b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> ?PT'4754 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> ?T4731 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 9. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (9 subgoals):
 1. \<And>thread epCPtr rv rva ret__unsigneda ntfn. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4754 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ntfn) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4729 (from_bool isBlocking) thread epCPtr epCPtr rv) (?T4731 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (IF ret__unsigned = 0 \<or> tcb_Ptr ret__unsigneda \<noteq> NULL \<and> tcb_Ptr ret__unsigneda \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 3. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 4. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ?R4729 isBlockinga thread rv epCPtr a b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> ?PT'4754 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc ntfn) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> ?T4731 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 9. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (8 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4729 (from_bool isBlocking) thread epCPtr epCPtr rv) (?T4731 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (IF ret__unsigned = 0 \<or> tcb_Ptr ret__unsigneda \<noteq> NULL \<and> tcb_Ptr ret__unsigneda \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 2. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 3. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ?R4729 isBlockinga thread rv epCPtr a b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> ?T4731 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 8. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (8 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4729 (from_bool isBlocking) thread epCPtr epCPtr rv) (?R'5084 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rva,from_bool isBlocking))
 2. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 3. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ?R4729 isBlockinga thread rv epCPtr a b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> ?R'5084 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc \<inter> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 8. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (9 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4729 (from_bool isBlocking) thread epCPtr epCPtr rv) (?P'5090 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C)
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5089 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 3. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 4. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ?R4729 isBlockinga thread rv epCPtr a b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> ?P'5090 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc \<inter> ?R'5089 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc \<inter> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 9. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (9 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4729 (from_bool isBlocking) thread epCPtr epCPtr rv) (?P'5090 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (do a <- throwError (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
(\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
(CALL handleFault_'proc(\<acute>ksCurThread);;
break_C)))
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5089 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 3. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 4. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ?R4729 isBlockinga thread rv epCPtr a b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> ?P'5090 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc \<inter> ?R'5089 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc \<inter> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 9. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (9 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4729 (from_bool isBlocking) thread epCPtr epCPtr rv) (?P'5090 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)))) [catchbrk_C, SKIP] (handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
(\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
(CALL handleFault_'proc(\<acute>ksCurThread);;
break_C)))
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5089 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 3. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 4. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ?R4729 isBlockinga thread rv epCPtr a b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> ?P'5090 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc \<inter> ?R'5089 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc \<inter> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 9. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (9 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'5109 (from_bool isBlocking) thread epCPtr epCPtr rv) (?Q5107 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)))) [catchbrk_C, SKIP] (handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
(\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
(CALL handleFault_'proc(\<acute>ksCurThread);;
break_C)))
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5089 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 3. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 4. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ?P'5109 isBlockinga thread rv epCPtr a) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5107 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc} \<inter> ?R'5089 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc \<inter> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 9. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (11 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'5109 (from_bool isBlocking) thread epCPtr epCPtr rv) (?Q'5112 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
(CALL handleFault_'proc(\<acute>ksCurThread);;
break_C))
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5107 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) (?Q'5112 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned)
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv; ?P'5109 (from_bool isBlocking) thread epCPtr epCPtr rv s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5107 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5089 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 5. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 6. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 7. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ?P'5109 isBlockinga thread rv epCPtr a) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 8. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5107 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc} \<inter> ?R'5089 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc \<inter> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 9. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 10. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'5120 (from_bool isBlocking) thread epCPtr epCPtr rv) (?Q5118 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
(CALL handleFault_'proc(\<acute>ksCurThread);;
break_C))
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5107 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5118 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned}
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv; ((\<lambda>_. True) and ?P'5120 (from_bool isBlocking) thread epCPtr epCPtr rv) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5107 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5089 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 5. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 6. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 7. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and ?P'5120 isBlockinga thread rv epCPtr a)) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 8. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5107 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc} \<inter> ?R'5089 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc \<inter> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 9. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 10. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'5120 (from_bool isBlocking) thread epCPtr epCPtr rv) (?Q'5123 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (CALL handleFault_'proc(\<acute>ksCurThread);;
break_C)
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5118 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) (?Q'5123 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned)
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv; ?P'5120 (from_bool isBlocking) thread epCPtr epCPtr rv s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5118 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5107 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5118 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned}
 5. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv; ((\<lambda>_. True) and ?P'5120 (from_bool isBlocking) thread epCPtr epCPtr rv) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5107 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 6. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5089 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 7. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 8. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 9. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and ?P'5120 isBlockinga thread rv epCPtr a)) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 10. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5107 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc} \<inter> ?R'5089 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc \<inter> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'5120 (from_bool isBlocking) thread epCPtr epCPtr rv) (?Q'5123 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned) [catchbrk_C, SKIP] (handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0)) >>= return) (CALL handleFault_'proc(\<acute>ksCurThread);;
break_C)
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5118 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) (?Q'5123 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned)
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv; ?P'5120 (from_bool isBlocking) thread epCPtr epCPtr rv s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5118 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5107 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5118 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned}
 5. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv; ((\<lambda>_. True) and ?P'5120 (from_bool isBlocking) thread epCPtr epCPtr rv) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5107 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 6. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5089 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 7. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 8. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 9. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and ?P'5120 isBlockinga thread rv epCPtr a)) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 10. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5107 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc} \<inter> ?R'5089 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc \<inter> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
A total of 13 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned rvb xfdca. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv; dc rvb xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q5134 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned rvb) (?Q'5134 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned rvb xfdca) [catchbrk_C, SKIP] (return rvb) break_C
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<lbrace>?R5137 (from_bool isBlocking) thread epCPtr epCPtr rv\<rbrace> handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0)) \<lbrace>?Q5134 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5134 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned) CALL handleFault_'proc(\<acute>ksCurThread) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?Q'5134 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned rvb (xfdc s)}
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5118 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5134 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned)
 5. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R5137 (from_bool isBlocking) thread epCPtr epCPtr rv) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5118 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 6. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5107 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5118 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned}
 7. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv; ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R5137 (from_bool isBlocking) thread epCPtr epCPtr rv)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5107 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 8. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5089 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 9. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 10. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned rvb xfdca s s'. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv; dc rvb xfdca; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> dc rvb (xfdc s')
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned rvb xfdca s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv; dc rvb xfdca\<rbrakk> \<Longrightarrow> xfdc (s\<lparr>global_exn_var_' := Break\<rparr>) = xfdc s
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<lbrace>?R5137 (from_bool isBlocking) thread epCPtr epCPtr rv\<rbrace> handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0)) \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5134 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned) CALL handleFault_'proc(\<acute>ksCurThread) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 5. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5118 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5134 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned)
 6. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R5137 (from_bool isBlocking) thread epCPtr epCPtr rv) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5118 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 7. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5107 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5118 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned}
 8. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv; ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R5137 (from_bool isBlocking) thread epCPtr epCPtr rv)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5107 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 9. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5089 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 10. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
A total of 16 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<lbrace>?R5137 (from_bool isBlocking) thread epCPtr epCPtr rv\<rbrace> handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0)) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5134 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned) CALL handleFault_'proc(\<acute>ksCurThread) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5118 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5134 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned)
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R5137 (from_bool isBlocking) thread epCPtr epCPtr rv) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5118 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 5. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5107 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5118 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned}
 6. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv; ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R5137 (from_bool isBlocking) thread epCPtr epCPtr rv)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5107 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 7. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5089 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 8. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 9. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 10. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R5137 isBlockinga thread rv epCPtr a))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5134 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned) CALL handleFault_'proc(\<acute>ksCurThread) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5118 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5134 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned)
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5118 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5107 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5118 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned}
 5. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv; ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5107 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 6. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5089 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 7. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 8. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 9. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 10. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5107 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc} \<inter> ?R'5089 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc \<inter> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5118 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5118 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5107 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5118 thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned}
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv; ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5107 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 5. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5089 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 6. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 7. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 8. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 9. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5107 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc} \<inter> ?R'5089 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc \<inter> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 10. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5107 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> \<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv; ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5107 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5089 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 5. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 6. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 7. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 8. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5107 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc} \<inter> ?R'5089 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc \<inter> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 9. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 10. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. \<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> (s, globals_update (current_fault_'_update (\<lambda>_. ret__struct_seL4_Fault_C_' t)) sa) \<in> rf_sr}
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5107 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> \<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv; ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5107 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 4. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5089 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 5. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 6. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 7. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 8. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5107 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc} \<inter> ?R'5089 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc \<inter> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 9. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 10. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5107 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> \<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv; ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5107 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 3. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5089 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 4. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 5. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 7. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5107 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc} \<inter> ?R'5089 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc \<inter> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 9. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 10. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (9 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv; ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))} \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5089 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 3. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 4. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> ?R'5089 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc \<inter> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 9. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (9 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned s. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv; ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) s\<rbrakk> \<Longrightarrow> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))} \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (s, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) sa) \<in> rf_sr}
 2. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5089 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 3. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 4. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> ?R'5089 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc \<inter> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 9. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (8 subgoals):
 1. \<And>thread epCPtr rv rva ntfnptr ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation rv (lookupCap_ret_C.cap_C rva); lookupCap_ret_C.status_C rva = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rv; isNotificationCap rv; ntfnptr = capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); ret__unsigned = capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva)); \<not> capNtfnCanReceive rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5089 (from_bool isBlocking) thread epCPtr epCPtr rv rva (cap_get_tag (lookupCap_ret_C.cap_C rva)) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C rva))) ret__unsigneda ret__unsigned) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C {},UNIV
 2. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 3. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>va. ntfnPtr_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. boundTCB_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va v'. va = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr va) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>vb v'. vb = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. vb = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr va))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr vb) sa \<in> {sa. \<forall>vc v'. vc = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>vb = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> ?R'5089 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v va vb vc \<inter> \<lbrace>vc = 0 \<or> tcb_Ptr vb \<noteq> NULL \<and> tcb_Ptr vb \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr va) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 8. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (7 subgoals):
 1. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (do a <- capFaultOnFailure epCPtr True (throwError (Fault_H.lookup_failure.MissingCapability 0));
case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a
od) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 2. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 3. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 5. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 7. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (7 subgoals):
 1. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 2. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 3. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 5. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 7. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (7 subgoals):
 1. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?U3880 (from_bool isBlocking) thread epCPtr epCPtr rva) (?U'3878 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
(\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 2. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 3. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ?U3880 isBlockinga thread rv epCPtr a s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> ?U'3878 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v)})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 5. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 7. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (7 subgoals):
 1. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'5370 (from_bool isBlocking) thread epCPtr epCPtr rva) (?Q5369 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) [catchbrk_C, SKIP] (handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
(\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)))
 2. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 3. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ((\<lambda>_. True) and ?P'5370 isBlockinga thread rv epCPtr a) s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5369 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v})})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 5. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 7. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (9 subgoals):
 1. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'5370 (from_bool isBlocking) thread epCPtr epCPtr rva) (?Q'5373 thread epCPtr rva rv') [catchbrk_C, SKIP] (handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 2. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5369 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) (?Q'5373 thread epCPtr rva rv')
 3. \<And>thread epCPtr rva rv' s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva; ?P'5370 (from_bool isBlocking) thread epCPtr epCPtr rva s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5369 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 4. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ((\<lambda>_. True) and ?P'5370 isBlockinga thread rv epCPtr a) s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5369 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v})})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 9. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (9 subgoals):
 1. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'5380 (from_bool isBlocking) thread epCPtr epCPtr rva) (?Q5378 thread epCPtr rva rv') [catchbrk_C, SKIP] (handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread))
 2. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5369 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5378 thread epCPtr rva rv'}
 3. \<And>thread epCPtr rva rv' s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva; ((\<lambda>_. True) and ?P'5380 (from_bool isBlocking) thread epCPtr epCPtr rva) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5369 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 4. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and ?P'5380 isBlockinga thread rv epCPtr a)) s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5369 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v})})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 9. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (11 subgoals):
 1. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'5380 (from_bool isBlocking) thread epCPtr epCPtr rva) (?Q'5383 thread epCPtr rva rv') [catchbrk_C, SKIP] (handleFault thread (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (CALL handleFault_'proc(\<acute>ksCurThread))
 2. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5378 thread epCPtr rva rv') \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) (?Q'5383 thread epCPtr rva rv')
 3. \<And>thread epCPtr rva rv' s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva; ?P'5380 (from_bool isBlocking) thread epCPtr epCPtr rva s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5378 thread epCPtr rva rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 4. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5369 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5378 thread epCPtr rva rv'}
 5. \<And>thread epCPtr rva rv' s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva; ((\<lambda>_. True) and ?P'5380 (from_bool isBlocking) thread epCPtr epCPtr rva) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5369 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 6. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 7. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and ?P'5380 isBlockinga thread rv epCPtr a)) s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 8. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5369 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v})})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 9. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 10. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5378 thread epCPtr rva rv') \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 2. \<And>thread epCPtr rva rv' s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5378 thread epCPtr rva rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 3. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5369 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5378 thread epCPtr rva rv'}
 4. \<And>thread epCPtr rva rv' s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva; ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5369 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 5. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p))))) s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 7. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5369 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v})})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 9. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 10. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (9 subgoals):
 1. \<And>thread epCPtr rva rv' s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 2. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5369 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> \<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 3. \<And>thread epCPtr rva rv' s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva; ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5369 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 4. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p))))) s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5369 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v})})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 9. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (9 subgoals):
 1. \<And>thread epCPtr rva rv' s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p))) s\<rbrakk> \<Longrightarrow> \<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. \<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> (s, globals_update (current_fault_'_update (\<lambda>_. ret__struct_seL4_Fault_C_' t)) sa) \<in> rf_sr}
 2. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5369 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> \<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 3. \<And>thread epCPtr rva rv' s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva; ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5369 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 4. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p))))) s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5369 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v})})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 9. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (8 subgoals):
 1. \<And>thread epCPtr rva rv'. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5369 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv'))) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> \<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 2. \<And>thread epCPtr rva rv' s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva; ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5369 (from_bool isBlocking) thread epCPtr epCPtr rva rv' (cap_get_tag (lookupCap_ret_C.cap_C rv')) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 3. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p))))) s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5369 isBlockinga thread rv epCPtr rv' (lu_ret___struct_lookupCap_ret_C_' s) v})})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 8. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (7 subgoals):
 1. \<And>thread epCPtr rva rv' s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva; ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))} \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0) {s'. (s, s') \<in> rf_sr}
 2. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 3. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p))))) s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}})})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 5. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 7. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (7 subgoals):
 1. \<And>thread epCPtr rva rv' s. \<lbrakk>ccap_relation rva (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> isEndpointCap rva; \<not> isNotificationCap rva; ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)))) s\<rbrakk> \<Longrightarrow> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))} \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (s, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) sa) \<in> rf_sr}
 2. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 3. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p))))) s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}})})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 5. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 7. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (6 subgoals):
 1. \<And>isBlockinga thread rv epCPtr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 isBlockinga thread rv epCPtr err) (?Q''2154 isBlockinga thread rv epCPtr err rv' err') [SKIP] (((\<lambda>a. case a of Inl a \<Rightarrow> handleFault thread a | Inr a \<Rightarrow> return a) \<circ> Inl) err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C
FI;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 2. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p))))) s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 3. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}})})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 4. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 5. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 6. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (6 subgoals):
 1. \<And>thread epCPtr rv' err' w. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 (from_bool isBlocking) thread epCPtr epCPtr (Fault_H.fault.CapFault epCPtr True w)) (?Q''2154 (from_bool isBlocking) thread epCPtr epCPtr (Fault_H.fault.CapFault epCPtr True w) rv' err') [SKIP] (handleFault thread (Fault_H.fault.CapFault epCPtr True w)) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 2. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p))))) s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 3. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}})})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 4. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 5. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 6. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (6 subgoals):
 1. \<And>thread epCPtr rv' err' w. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 (from_bool isBlocking) thread epCPtr epCPtr (Fault_H.fault.CapFault epCPtr True w)) (?Q''2154 (from_bool isBlocking) thread epCPtr epCPtr (Fault_H.fault.CapFault epCPtr True w) rv' err') [SKIP] (handleFault thread (Fault_H.fault.CapFault epCPtr True w) >>= return) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
return_void_C;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 2. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p))))) s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 3. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}})})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 4. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 5. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 6. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (6 subgoals):
 1. \<And>thread epCPtr rv' err' w. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE2154 (from_bool isBlocking) thread epCPtr epCPtr (Fault_H.fault.CapFault epCPtr True w)) (?Q''2154 (from_bool isBlocking) thread epCPtr epCPtr (Fault_H.fault.CapFault epCPtr True w) rv' err') [SKIP] (handleFault thread (Fault_H.fault.CapFault epCPtr True w) >>= return) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
(CALL handleFault_'proc(\<acute>ksCurThread);;
(return_void_C;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)))
 2. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p))))) s)) s)\<rbrace>, \<lbrace>?QE2154 isBlockinga thread rv epCPtr\<rbrace>
 3. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}})})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2154 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s))}
 4. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 5. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 6. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (6 subgoals):
 1. \<And>thread epCPtr rv' err' w. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'5501 (from_bool isBlocking) thread epCPtr epCPtr (Fault_H.fault.CapFault epCPtr True w)) (?Q5500 (from_bool isBlocking) thread epCPtr epCPtr (Fault_H.fault.CapFault epCPtr True w) rv' err') [SKIP] (handleFault thread (Fault_H.fault.CapFault epCPtr True w) >>= return) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
(CALL handleFault_'proc(\<acute>ksCurThread);;
(return_void_C;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)))
 2. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p))))) s)) s)\<rbrace>, \<lbrace>\<lambda>a. (\<lambda>_. True) and ?P'5501 isBlockinga thread rv epCPtr a\<rbrace>
 3. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}})})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5500 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)})}
 4. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 5. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 6. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (8 subgoals):
 1. \<And>thread epCPtr rv' err' w. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'5501 (from_bool isBlocking) thread epCPtr epCPtr (Fault_H.fault.CapFault epCPtr True w)) (?Q'5504 thread epCPtr rv' err' w) [SKIP] (handleFault thread (Fault_H.fault.CapFault epCPtr True w) >>= return) (CALL handleFault_'proc(\<acute>ksCurThread);;
(return_void_C;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END))
 2. \<And>thread epCPtr rv' err' w. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5500 (from_bool isBlocking) thread epCPtr epCPtr (Fault_H.fault.CapFault epCPtr True w) rv' err') \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) (?Q'5504 thread epCPtr rv' err' w)
 3. \<And>thread epCPtr rv' err' w s. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'; ?P'5501 (from_bool isBlocking) thread epCPtr epCPtr (Fault_H.fault.CapFault epCPtr True w) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5500 (from_bool isBlocking) thread epCPtr epCPtr (Fault_H.fault.CapFault epCPtr True w) rv' err' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p))))) s)) s)\<rbrace>, \<lbrace>\<lambda>a. (\<lambda>_. True) and ?P'5501 isBlockinga thread rv epCPtr a\<rbrace>
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}})})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5500 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)})}
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 8. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (10 subgoals):
 1. \<And>thread epCPtr rv' err' w rv xfdca. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'; dc rv xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q5512 thread epCPtr rv' err' w rv) (?Q'5512 thread epCPtr rv' err' w rv xfdca) [SKIP] (return rv) (return_void_C;;
TRY
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL deleteCallerCap_'proc(\<acute>ksCurThread);;
CALL receiveIPC_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init ntfnPtr_' ntfnPtr_'_update;;
lvar_nondet_init boundTCB_' boundTCB_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(lookupCap_ret_C.cap_C rv');;
\<acute>ntfnPtr :== ntfn_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnBoundTCB_'proc(\<acute>ntfnPtr);;
\<acute>boundTCB :== tcb_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(lookupCap_ret_C.cap_C rv');;
IF \<acute>ret__unsigned = 0 \<or> \<acute>boundTCB \<noteq> NULL \<and> \<acute>boundTCB \<noteq> \<acute>ksCurThread THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread);;
break_C
FI;;
CALL receiveSignal_'proc(\<acute>ksCurThread,lookupCap_ret_C.cap_C rv',from_bool isBlocking)
ELSE
  \<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true);;
CALL handleFault_'proc(\<acute>ksCurThread)
FI
FI
CATCH catchbrk_C
END)
 2. \<And>thread epCPtr rv' err' w. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<lbrace>?R5515 (from_bool isBlocking) thread epCPtr epCPtr (Fault_H.fault.CapFault epCPtr True w)\<rbrace> handleFault thread (Fault_H.fault.CapFault epCPtr True w) \<lbrace>?Q5512 thread epCPtr rv' err' w\<rbrace>
 3. \<And>thread epCPtr rv' err' w. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5512 thread epCPtr rv' err' w) CALL handleFault_'proc(\<acute>ksCurThread) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'5512 thread epCPtr rv' err' w rv (xfdc s)}
 4. \<And>thread epCPtr rv' err' w. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5500 (from_bool isBlocking) thread epCPtr epCPtr (Fault_H.fault.CapFault epCPtr True w) rv' err') \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.CapFault epCPtr True w)) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5512 thread epCPtr rv' err' w)
 5. \<And>thread epCPtr rv' err' w s. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R5515 (from_bool isBlocking) thread epCPtr epCPtr (Fault_H.fault.CapFault epCPtr True w)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5500 (from_bool isBlocking) thread epCPtr epCPtr (Fault_H.fault.CapFault epCPtr True w) rv' err' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p))))) s)) s)\<rbrace>, \<lbrace>\<lambda>a. (\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R5515 isBlockinga thread rv epCPtr a)\<rbrace>
 7. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}})})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5500 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)})}
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 9. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 10. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (11 subgoals):
 1. \<And>thread epCPtr rv' err' w rv xfdca. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'; dc rv xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q5512 thread epCPtr rv' err' w rv) (?P'5544 thread epCPtr rv' err' w rv xfdca) [SKIP] (return rv) return_void_C
 2. \<And>thread epCPtr rv' err' w rv xfdc. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'; dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5544 thread epCPtr rv' err' w rv xfdc) return_void_C {},UNIV
 3. \<And>thread epCPtr rv' err' w. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<lbrace>?R5515 (from_bool isBlocking) thread epCPtr epCPtr (Fault_H.fault.CapFault epCPtr True w)\<rbrace> handleFault thread (Fault_H.fault.CapFault epCPtr True w) \<lbrace>?Q5512 thread epCPtr rv' err' w\<rbrace>
 4. \<And>thread epCPtr rv' err' w. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5512 thread epCPtr rv' err' w) CALL handleFault_'proc(\<acute>ksCurThread) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?P'5544 thread epCPtr rv' err' w rv (xfdc s) \<inter> ?R'5544 thread epCPtr rv' err' w rv (xfdc s)}
 5. \<And>thread epCPtr rv' err' w. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5500 (from_bool isBlocking) thread epCPtr epCPtr (Fault_H.fault.CapFault epCPtr True w) rv' err') \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.CapFault epCPtr True w)) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5512 thread epCPtr rv' err' w)
 6. \<And>thread epCPtr rv' err' w s. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R5515 (from_bool isBlocking) thread epCPtr epCPtr (Fault_H.fault.CapFault epCPtr True w)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5500 (from_bool isBlocking) thread epCPtr epCPtr (Fault_H.fault.CapFault epCPtr True w) rv' err' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 7. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p))))) s)) s)\<rbrace>, \<lbrace>\<lambda>a. (\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R5515 isBlockinga thread rv epCPtr a)\<rbrace>
 8. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}})})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5500 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)})}
 9. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 10. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>thread epCPtr rv' err' w rv xfdc. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'; dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5544 thread epCPtr rv' err' w rv xfdc) return_void_C {},UNIV
 2. \<And>thread epCPtr rv' err' w. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<lbrace>?R5515 (from_bool isBlocking) thread epCPtr epCPtr (Fault_H.fault.CapFault epCPtr True w)\<rbrace> handleFault thread (Fault_H.fault.CapFault epCPtr True w) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>thread epCPtr rv' err' w. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5512 thread epCPtr rv' err' w) CALL handleFault_'proc(\<acute>ksCurThread) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> ?R'5544 thread epCPtr rv' err' w rv (xfdc s)}
 4. \<And>thread epCPtr rv' err' w. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5500 (from_bool isBlocking) thread epCPtr epCPtr (Fault_H.fault.CapFault epCPtr True w) rv' err') \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.CapFault epCPtr True w)) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5512 thread epCPtr rv' err' w)
 5. \<And>thread epCPtr rv' err' w s. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R5515 (from_bool isBlocking) thread epCPtr epCPtr (Fault_H.fault.CapFault epCPtr True w)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5500 (from_bool isBlocking) thread epCPtr epCPtr (Fault_H.fault.CapFault epCPtr True w) rv' err' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p))))) s)) s)\<rbrace>, \<lbrace>\<lambda>a. (\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R5515 isBlockinga thread rv epCPtr a)\<rbrace>
 7. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}})})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5500 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)})}
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 9. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 10. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (9 subgoals):
 1. \<And>thread epCPtr rv' err' w. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<lbrace>?R5515 (from_bool isBlocking) thread epCPtr epCPtr (Fault_H.fault.CapFault epCPtr True w)\<rbrace> handleFault thread (Fault_H.fault.CapFault epCPtr True w) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>thread epCPtr rv' err' w. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5512 thread epCPtr rv' err' w) CALL handleFault_'proc(\<acute>ksCurThread) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 3. \<And>thread epCPtr rv' err' w. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5500 (from_bool isBlocking) thread epCPtr epCPtr (Fault_H.fault.CapFault epCPtr True w) rv' err') \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.CapFault epCPtr True w)) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5512 thread epCPtr rv' err' w)
 4. \<And>thread epCPtr rv' err' w s. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R5515 (from_bool isBlocking) thread epCPtr epCPtr (Fault_H.fault.CapFault epCPtr True w)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5500 (from_bool isBlocking) thread epCPtr epCPtr (Fault_H.fault.CapFault epCPtr True w) rv' err' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p))))) s)) s)\<rbrace>, \<lbrace>\<lambda>a. (\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R5515 isBlockinga thread rv epCPtr a)\<rbrace>
 6. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}})})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5500 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)})}
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 8. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 9. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (8 subgoals):
 1. \<And>thread epCPtr rv' err' w. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5512 thread epCPtr rv' err' w) CALL handleFault_'proc(\<acute>ksCurThread) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 2. \<And>thread epCPtr rv' err' w. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5500 (from_bool isBlocking) thread epCPtr epCPtr (Fault_H.fault.CapFault epCPtr True w) rv' err') \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.CapFault epCPtr True w)) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5512 thread epCPtr rv' err' w)
 3. \<And>thread epCPtr rv' err' w s. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5500 (from_bool isBlocking) thread epCPtr epCPtr (Fault_H.fault.CapFault epCPtr True w) rv' err' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p))))) s)) s)\<rbrace>, \<lbrace>\<lambda>a. (\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))\<rbrace>
 5. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}})})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5500 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)})}
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 7. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 8. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (7 subgoals):
 1. \<And>thread epCPtr rv' err' w. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5500 (from_bool isBlocking) thread epCPtr epCPtr (Fault_H.fault.CapFault epCPtr True w) rv' err') \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.CapFault epCPtr True w)) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 2. \<And>thread epCPtr rv' err' w s. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q5500 (from_bool isBlocking) thread epCPtr epCPtr (Fault_H.fault.CapFault epCPtr True w) rv' err' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 3. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p))))) s)) s)\<rbrace>, \<lbrace>\<lambda>a. (\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))\<rbrace>
 4. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}})})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q5500 isBlockinga thread rv epCPtr ft (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)})}
 5. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 6. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 7. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (6 subgoals):
 1. \<And>thread epCPtr rv' err' w s. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True w)) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(epCPtr,SCAST(32 signed \<rightarrow> 32) true) {s'. (s, s') \<in> rf_sr}
 2. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p))))) s)) s)\<rbrace>, \<lbrace>\<lambda>a. (\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))\<rbrace>
 3. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}})})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> \<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>})}
 4. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 5. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 6. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (6 subgoals):
 1. \<And>thread epCPtr rv' err' w s. \<lbrakk>lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv') err'; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True w)) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. \<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> (s, globals_update (current_fault_'_update (\<lambda>_. ret__struct_seL4_Fault_C_' t)) sa) \<in> rf_sr}
 2. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p))))) s)) s)\<rbrace>, \<lbrace>\<lambda>a. (\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))\<rbrace>
 3. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}})})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> \<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>})}
 4. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 5. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 6. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (5 subgoals):
 1. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R2164 (from_bool isBlocking) thread epCPtr\<rbrace> capFaultOnFailure epCPtr True (lookupCap thread epCPtr) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive a \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ksCurThread b = thread \<and> invs' b \<and> st_tcb_at' simple' thread b \<and> sch_act_not thread b \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) b) \<and> valid_cap' a b \<and> K (isEndpointCap a) b)) s)) s) and (\<lambda>s. \<not> isEndpointCap a \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap a \<longrightarrow> (valid_cap' a and (\<lambda>b. (capNtfnCanReceive a \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr a) b \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' a and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap a)) s)) b)) \<and> (\<not> capNtfnCanReceive a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) b))) s) and (\<lambda>s. \<not> isNotificationCap a \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p))))) s)) s)\<rbrace>, \<lbrace>\<lambda>a. (\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))\<rbrace>
 2. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}})})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> \<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>})}
 3. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and ?R2164 isBlockinga thread a\<rbrace>
 4. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 5. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (5 subgoals):
 1. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<lbrace>?P'5640 (from_bool isBlocking) thread epCPtr\<rbrace> lookupCap thread epCPtr \<lbrace>\<lambda>rv s. (isEndpointCap rv \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanReceive rv \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. capEPCanReceive rv \<longrightarrow> ((\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>a. ksCurThread a = thread \<and> invs' a \<and> st_tcb_at' simple' thread a \<and> sch_act_not thread a \<and> (\<forall>x xa. (invs' and ct_in_state' simple' and sch_act_sane and (\<lambda>s. ksCurThread s \<notin> set (ksReadyQueues s (x, xa)) \<and> thread = ksCurThread s)) a) \<and> valid_cap' rv a \<and> K (isEndpointCap rv) a)) s)) s) \<and> (\<not> isEndpointCap rv \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isNotificationCap rv \<longrightarrow> (valid_cap' rv and (\<lambda>a. (capNtfnCanReceive rv \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr rv) a \<longrightarrow> (valid_ntfn' ntfn and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. \<not> (ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None) \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) s) and (\<lambda>s. ntfnBoundTCB ntfn = Some thread \<or> ntfnBoundTCB ntfn = None \<longrightarrow> (invs' and valid_cap' rv and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and K (isNotificationCap rv)) s)) a)) \<and> (\<not> capNtfnCanReceive rv \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)))) a))) s) and (\<lambda>s. \<not> isNotificationCap rv \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p))))) s)) s)\<rbrace>, -
 2. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}})})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> \<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>})}
 3. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) b \<and> True \<and> ?P'5640 isBlockinga thread a b)\<rbrace>
 4. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 5. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (5 subgoals):
 1. \<And>thread epCPtr. \<lbrace>?P'5640 (from_bool isBlocking) thread epCPtr\<rbrace> lookupCap thread epCPtr \<lbrace>\<lambda>rv s. (isEndpointCap rv \<longrightarrow> (\<not> capEPCanReceive rv \<longrightarrow> invs' s \<and> st_tcb_at' simple' thread s \<and> sch_act_not thread s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b)))) \<and> (capEPCanReceive rv \<longrightarrow> invs' s \<and> tcb_at' thread s \<and> ksCurThread s = thread \<and> invs' s \<and> st_tcb_at' simple' thread s \<and> sch_act_not thread s \<and> invs' s \<and> ct_in_state' simple' s \<and> sch_act_sane s \<and> (\<forall>x xa. ksCurThread s \<notin> set (ksReadyQueues s (x, xa))) \<and> thread = ksCurThread s \<and> valid_cap' rv s)) \<and> (\<not> isEndpointCap rv \<longrightarrow> (isNotificationCap rv \<longrightarrow> valid_cap' rv s \<and> (capNtfnCanReceive rv \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr rv) s \<longrightarrow> valid_ntfn' ntfn s \<and> thread = ksCurThread s \<and> (ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> invs' s \<and> st_tcb_at' simple' thread s \<and> sch_act_not thread s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b)))) \<and> (ntfnBoundTCB ntfn = Some thread \<longrightarrow> invs' s \<and> valid_cap' rv s \<and> st_tcb_at' simple' thread s \<and> sch_act_not thread s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) \<and> (ntfnBoundTCB ntfn = None \<longrightarrow> invs' s \<and> valid_cap' rv s \<and> st_tcb_at' simple' thread s \<and> sch_act_not thread s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))))) \<and> (\<not> capNtfnCanReceive rv \<longrightarrow> invs' s \<and> st_tcb_at' simple' thread s \<and> sch_act_not thread s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))))) \<and> (\<not> isNotificationCap rv \<longrightarrow> invs' s \<and> st_tcb_at' simple' thread s \<and> sch_act_not thread s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b)))))\<rbrace>, -
 2. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}})})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> \<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>})}
 3. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) b \<and> True \<and> ?P'5640 isBlockinga thread a b)\<rbrace>
 4. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 5. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (5 subgoals):
 1. \<And>thread epCPtr. \<lbrace>?P'5640 (from_bool isBlocking) thread epCPtr\<rbrace> lookupCap thread epCPtr \<lbrace>\<lambda>rv s. (isEndpointCap rv \<longrightarrow> (\<not> capEPCanReceive rv \<longrightarrow> invs' s \<and> st_tcb_at' simple' thread s \<and> sch_act_not thread s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b)))) \<and> (capEPCanReceive rv \<longrightarrow> invs' s \<and> tcb_at' thread s \<and> ksCurThread s = thread \<and> invs' s \<and> st_tcb_at' simple' thread s \<and> sch_act_not thread s \<and> invs' s \<and> ct_in_state' simple' s \<and> sch_act_sane s \<and> (\<forall>x xa. ksCurThread s \<notin> set (ksReadyQueues s (x, xa))) \<and> thread = ksCurThread s \<and> valid_cap' rv s)) \<and> (\<not> isEndpointCap rv \<longrightarrow> (isNotificationCap rv \<longrightarrow> valid_cap' rv s \<and> (capNtfnCanReceive rv \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr rv) s \<longrightarrow> valid_ntfn' ntfn s \<and> thread = ksCurThread s \<and> (ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> invs' s \<and> st_tcb_at' simple' thread s \<and> sch_act_not thread s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b)))) \<and> (ntfnBoundTCB ntfn = Some thread \<longrightarrow> invs' s \<and> valid_cap' rv s \<and> st_tcb_at' simple' thread s \<and> sch_act_not thread s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) \<and> (ntfnBoundTCB ntfn = None \<longrightarrow> invs' s \<and> valid_cap' rv s \<and> st_tcb_at' simple' thread s \<and> sch_act_not thread s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))))) \<and> (\<not> capNtfnCanReceive rv \<longrightarrow> invs' s \<and> st_tcb_at' simple' thread s \<and> sch_act_not thread s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))))) \<and> (\<not> isNotificationCap rv \<longrightarrow> invs' s \<and> st_tcb_at' simple' thread s \<and> sch_act_not thread s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b)))))\<rbrace>, -
 2. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}})})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> \<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>})}
 3. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) b \<and> True \<and> ?P'5640 isBlockinga thread a b)\<rbrace>
 4. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 5. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (6 subgoals):
 1. \<And>thread epCPtr rv s. invs' s \<and> st_tcb_at' simple' thread s \<and> sch_act_sane s \<and> (\<forall>p. thread \<notin> set (ksReadyQueues s p)) \<and> thread = ksCurThread s \<and> valid_cap' rv s \<Longrightarrow> (isEndpointCap rv \<longrightarrow> (\<not> capEPCanReceive rv \<longrightarrow> invs' s \<and> st_tcb_at' simple' thread s \<and> sch_act_not thread s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b)))) \<and> (capEPCanReceive rv \<longrightarrow> invs' s \<and> tcb_at' thread s \<and> ksCurThread s = thread \<and> invs' s \<and> st_tcb_at' simple' thread s \<and> sch_act_not thread s \<and> invs' s \<and> ct_in_state' simple' s \<and> sch_act_sane s \<and> (\<forall>x xa. ksCurThread s \<notin> set (ksReadyQueues s (x, xa))) \<and> thread = ksCurThread s \<and> valid_cap' rv s)) \<and> (\<not> isEndpointCap rv \<longrightarrow> (isNotificationCap rv \<longrightarrow> valid_cap' rv s \<and> (capNtfnCanReceive rv \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr rv) s \<longrightarrow> valid_ntfn' ntfn s \<and> thread = ksCurThread s \<and> (ntfnBoundTCB ntfn \<noteq> Some thread \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> invs' s \<and> st_tcb_at' simple' thread s \<and> sch_act_not thread s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b)))) \<and> (ntfnBoundTCB ntfn = Some thread \<longrightarrow> invs' s \<and> valid_cap' rv s \<and> st_tcb_at' simple' thread s \<and> sch_act_not thread s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) \<and> (ntfnBoundTCB ntfn = None \<longrightarrow> invs' s \<and> valid_cap' rv s \<and> st_tcb_at' simple' thread s \<and> sch_act_not thread s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))))) \<and> (\<not> capNtfnCanReceive rv \<longrightarrow> invs' s \<and> st_tcb_at' simple' thread s \<and> sch_act_not thread s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b))))) \<and> (\<not> isNotificationCap rv \<longrightarrow> invs' s \<and> st_tcb_at' simple' thread s \<and> sch_act_not thread s \<and> (\<forall>a b. thread \<notin> set (ksReadyQueues s (a, b)))))
 2. \<And>thread epCPtr. \<lbrace>?P'5640 (from_bool isBlocking) thread epCPtr\<rbrace> lookupCap thread epCPtr \<lbrace>\<lambda>rv s. invs' s \<and> st_tcb_at' simple' thread s \<and> sch_act_sane s \<and> (\<forall>p. thread \<notin> set (ksReadyQueues s p)) \<and> thread = ksCurThread s \<and> valid_cap' rv s\<rbrace>, -
 3. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}})})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> \<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>})}
 4. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) b \<and> True \<and> ?P'5640 isBlockinga thread a b)\<rbrace>
 5. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 6. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (6 subgoals):
 1. \<And>rv s. \<lbrakk>invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_cap' rv s\<rbrakk> \<Longrightarrow> (isEndpointCap rv \<longrightarrow> (\<not> capEPCanReceive rv \<longrightarrow> sch_act_not (ksCurThread s) s) \<and> (capEPCanReceive rv \<longrightarrow> tcb_at' (ksCurThread s) s \<and> sch_act_not (ksCurThread s) s \<and> ct_in_state' simple' s)) \<and> (\<not> isEndpointCap rv \<longrightarrow> (isNotificationCap rv \<longrightarrow> (capNtfnCanReceive rv \<longrightarrow> (\<forall>ntfn. ko_at' ntfn (capNtfnPtr rv) s \<longrightarrow> valid_ntfn' ntfn s \<and> (ntfnBoundTCB ntfn \<noteq> Some (ksCurThread s) \<and> (\<exists>y. ntfnBoundTCB ntfn = Some y) \<longrightarrow> sch_act_not (ksCurThread s) s) \<and> (ntfnBoundTCB ntfn = Some (ksCurThread s) \<longrightarrow> sch_act_not (ksCurThread s) s) \<and> (ntfnBoundTCB ntfn = None \<longrightarrow> sch_act_not (ksCurThread s) s))) \<and> (\<not> capNtfnCanReceive rv \<longrightarrow> sch_act_not (ksCurThread s) s)) \<and> (\<not> isNotificationCap rv \<longrightarrow> sch_act_not (ksCurThread s) s))
 2. \<And>thread epCPtr. \<lbrace>?P'5640 (from_bool isBlocking) thread epCPtr\<rbrace> lookupCap thread epCPtr \<lbrace>\<lambda>rv s. invs' s \<and> st_tcb_at' simple' thread s \<and> sch_act_sane s \<and> (\<forall>p. thread \<notin> set (ksReadyQueues s p)) \<and> thread = ksCurThread s \<and> valid_cap' rv s\<rbrace>, -
 3. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}})})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> \<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>})}
 4. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) b \<and> True \<and> ?P'5640 isBlockinga thread a b)\<rbrace>
 5. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 6. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (5 subgoals):
 1. \<And>thread epCPtr. \<lbrace>?P'5640 (from_bool isBlocking) thread epCPtr\<rbrace> lookupCap thread epCPtr \<lbrace>\<lambda>rv s. invs' s \<and> st_tcb_at' simple' thread s \<and> sch_act_sane s \<and> (\<forall>p. thread \<notin> set (ksReadyQueues s p)) \<and> thread = ksCurThread s \<and> valid_cap' rv s\<rbrace>, -
 2. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}})})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> \<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>})}
 3. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>b. ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) b \<and> True \<and> ?P'5640 isBlockinga thread a b)\<rbrace>
 4. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 5. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (4 subgoals):
 1. \<And>isBlockinga thread rv epCPtr. \<lbrakk>isBlockinga = from_bool isBlocking; rv = epCPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (\<forall>rv'. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capCanReceive_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> (if v = 0 then UNIV else {}) \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (sa \<notin> (if isEndpointCap rv' then UNIV else {}) \<longrightarrow> sa \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>v. ntfnPtr_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. boundTCB_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) sa \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_cap' rv' sa \<longrightarrow> s' \<in> {sa. \<forall>va v'. va = ntfnBoundTCB_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) sa))))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {s. va = ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr v))))} \<longrightarrow> sa \<in> {sa. boundTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>v v'. v = capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. (capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>ntfn sa. (sa, s') \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa \<longrightarrow> s' \<in> \<lbrace>va = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> {sa. isBlocking_'_update (\<lambda>_. isBlockinga) (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = isBlockinga\<rbrace>})}}) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v = 0 \<or> tcb_Ptr va \<noteq> NULL \<and> tcb_Ptr va \<noteq> \<acute>ksCurThread\<rbrace>)}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfn_Ptr v) s)}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}}) \<and> (sa \<notin> (if isNotificationCap rv' then UNIV else {}) \<longrightarrow> sa \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> {s. \<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<forall>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s) \<in> rf_sr \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))}})})}}) \<and> (\<forall>ft. lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> \<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>})}
 2. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>a. ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) a \<and> True \<and> invs' a \<and> st_tcb_at' simple' thread a \<and> sch_act_sane a \<and> (\<forall>p. thread \<notin> set (ksReadyQueues a p)) \<and> thread = ksCurThread a \<and> valid_objs' a)\<rbrace>
 3. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 4. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (4 subgoals):
 1. \<And>thread epCPtr. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2158 (from_bool isBlocking) thread epCPtr epCPtr) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(\<acute>ksCurThread,epCPtr) {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv'. ccap_relation rv' (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> (isEndpointCap rv' \<longrightarrow> (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s))) = 0 \<longrightarrow> (\<exists>sa. (sa, s\<lparr>ret__unsigned_' := 0\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) (s\<lparr>ret__unsigned_' := 0\<rparr>)) \<in> rf_sr) \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))) \<and> (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s))) \<noteq> 0 \<longrightarrow> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread) \<and> cap_get_tag (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<and> (\<not> isEndpointCap rv' \<longrightarrow> (isNotificationCap rv' \<longrightarrow> ((\<exists>v sa. (sa, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s))))) (s\<lparr>boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' sa) \<longrightarrow> (capNtfnCanReceive rv' \<longrightarrow> (\<forall>ntfn. (\<exists>sa. (sa, s\<lparr>ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)))\<rparr>) \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa) \<longrightarrow> ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)))))))) = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)) \<and> (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s))) = 0 \<longrightarrow> (\<exists>sa. (sa, s\<lparr>ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s))))))))), ret__unsigned_' := 0\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) (s\<lparr>ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s))))))))), ret__unsigned_' := 0\<rparr>)) \<in> rf_sr) \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))) \<and> (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)))))))) \<noteq> 0 \<and> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s))))))))) \<noteq> ksCurThread_' (globals s) \<longrightarrow> (\<exists>sa. (sa, s\<lparr>ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) (s\<lparr>ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)))\<rparr>)) \<in> rf_sr) \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))) \<and> (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s))) \<noteq> 0 \<and> (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)))))))) = 0 \<or> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s))))))))) = ksCurThread_' (globals s)) \<longrightarrow> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> ((\<exists>sa. (sa, s\<lparr>ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) (s\<lparr>ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)))\<rparr>)) \<in> rf_sr) \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))) \<and> (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s))) = 0 \<or> ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)))))))) \<noteq> 0 \<and> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s))))))))) \<noteq> ksCurThread_' (globals s))) \<and> cap_get_tag (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> s \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s))))) \<and> cap_get_tag (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> isNotificationCap rv' \<longrightarrow> (\<exists>sa. (sa, s\<lparr>ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' t) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>sa. (sa, globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) (s\<lparr>ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s))\<rparr>)) \<in> rf_sr) \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault epCPtr True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (ret__struct_lookup_fault_C_' t)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread)))))) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>ft. (\<exists>w. ft = Fault_H.fault.CapFault epCPtr True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> (\<exists>sa. (sa, s) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (current_lookup_fault_' (globals s))) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread)))}
 2. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>a. ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) a \<and> True \<and> invs' a \<and> st_tcb_at' simple' thread a \<and> sch_act_sane a \<and> (\<forall>p. thread \<notin> set (ksReadyQueues a p)) \<and> thread = ksCurThread a \<and> valid_objs' a)\<rbrace>
 3. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2158 isBlockinga thread rv (epCPtr_' s)}
 4. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (3 subgoals):
 1. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<lbrace>?R1452 isBlockinga thread\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' thread a) and (\<lambda>a. ((\<lambda>_. True) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) a \<and> True \<and> invs' a \<and> st_tcb_at' simple' thread a \<and> sch_act_sane a \<and> (\<forall>p. thread \<notin> set (ksReadyQueues a p)) \<and> thread = ksCurThread a \<and> valid_objs' a)\<rbrace>
 2. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {sa. \<forall>t. (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv'. ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<longrightarrow> (isEndpointCap rv' \<longrightarrow> (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<longrightarrow> (\<exists>s. (s, sa\<lparr>globals := globals sa\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := 0\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, sa\<lparr>lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := 0, globals := globals sa\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr_' s, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (epCPtr_' s) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta)) \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread))) \<and> (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) \<noteq> 0 \<longrightarrow> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread) \<and> cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<and> (\<not> isEndpointCap rv' \<longrightarrow> (isNotificationCap rv' \<longrightarrow> ((\<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (sa\<lparr>globals := globals sa\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s) \<longrightarrow> (capNtfnCanReceive rv' \<longrightarrow> (\<forall>ntfn. (\<exists>s. (s, sa\<lparr>globals := globals sa\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') s) \<longrightarrow> ntfnBoundTCB_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)) \<and> (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<longrightarrow> (\<exists>s. (s, sa\<lparr>globals := globals sa\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := 0\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, sa\<lparr>lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := 0, globals := globals sa\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr_' s, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (epCPtr_' s) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta)) \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread))) \<and> (ntfnBoundTCB_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) \<noteq> 0 \<and> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) \<noteq> ksCurThread_' (globals sa) \<longrightarrow> (\<exists>s. (s, sa\<lparr>globals := globals sa\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, sa\<lparr>lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))), globals := globals sa\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr_' s, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (epCPtr_' s) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta)) \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread))) \<and> (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) \<noteq> 0 \<and> (ntfnBoundTCB_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) = 0 \<or> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) = ksCurThread_' (globals sa)) \<longrightarrow> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread))) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> ((\<exists>s. (s, sa\<lparr>globals := globals sa\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, sa\<lparr>lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))), globals := globals sa\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr_' s, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (epCPtr_' s) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta)) \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread))) \<and> (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<or> ntfnBoundTCB_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) \<noteq> 0 \<and> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) \<noteq> ksCurThread_' (globals sa))) \<and> cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> sa \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) \<and> cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> isNotificationCap rv' \<longrightarrow> (\<exists>s. (s, sa\<lparr>globals := globals sa\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, sa\<lparr>lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)), globals := globals sa\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr_' s, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (epCPtr_' s) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta)) \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread)))))) \<and> (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>ft. (\<exists>w. ft = Fault_H.fault.CapFault (epCPtr_' s) True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t)) (errstate (sa\<lparr>globals := globals sa\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t\<rparr>))) \<longrightarrow> (\<exists>s. (s, sa\<lparr>globals := globals sa\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr_' s, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (current_lookup_fault_' (globals t))) \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread)))}}
 3. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R1452 isBlockinga rv) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (2 subgoals):
 1. \<And>isBlockinga thread. isBlockinga = from_bool isBlocking \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 isBlockinga thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. \<forall>rv. rv = epCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. epCPtr_' s) (thread_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = \<^bsup>s\<^esup>epCPtr\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {sa. \<forall>t. (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv'. ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<longrightarrow> (isEndpointCap rv' \<longrightarrow> (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<longrightarrow> (\<exists>s. (s, sa\<lparr>globals := globals sa\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := 0\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, sa\<lparr>lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := 0, globals := globals sa\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr_' s, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (epCPtr_' s) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta)) \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread))) \<and> (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) \<noteq> 0 \<longrightarrow> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread) \<and> cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<and> (\<not> isEndpointCap rv' \<longrightarrow> (isNotificationCap rv' \<longrightarrow> ((\<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (sa\<lparr>globals := globals sa\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s) \<longrightarrow> (capNtfnCanReceive rv' \<longrightarrow> (\<forall>ntfn. (\<exists>s. (s, sa\<lparr>globals := globals sa\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') s) \<longrightarrow> ntfnBoundTCB_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)) \<and> (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<longrightarrow> (\<exists>s. (s, sa\<lparr>globals := globals sa\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := 0\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, sa\<lparr>lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := 0, globals := globals sa\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr_' s, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (epCPtr_' s) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta)) \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread))) \<and> (ntfnBoundTCB_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) \<noteq> 0 \<and> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) \<noteq> ksCurThread_' (globals sa) \<longrightarrow> (\<exists>s. (s, sa\<lparr>globals := globals sa\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, sa\<lparr>lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))), globals := globals sa\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr_' s, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (epCPtr_' s) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta)) \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread))) \<and> (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) \<noteq> 0 \<and> (ntfnBoundTCB_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) = 0 \<or> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) = ksCurThread_' (globals sa)) \<longrightarrow> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread))) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> ((\<exists>s. (s, sa\<lparr>globals := globals sa\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, sa\<lparr>lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))), globals := globals sa\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr_' s, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (epCPtr_' s) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta)) \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread))) \<and> (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<or> ntfnBoundTCB_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) \<noteq> 0 \<and> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift sa (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) \<noteq> ksCurThread_' (globals sa))) \<and> cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> sa \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) \<and> cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> isNotificationCap rv' \<longrightarrow> (\<exists>s. (s, sa\<lparr>globals := globals sa\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, sa\<lparr>lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)), globals := globals sa\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr_' s, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (epCPtr_' s) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta)) \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread)))))) \<and> (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>ft. (\<exists>w. ft = Fault_H.fault.CapFault (epCPtr_' s) True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t)) (errstate (sa\<lparr>globals := globals sa\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t\<rparr>))) \<longrightarrow> (\<exists>s. (s, sa\<lparr>globals := globals sa\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr_' s, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (current_lookup_fault_' (globals t))) \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread)))}}
 2. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>a. invs' a \<and> tcb_at' rv a) and (\<lambda>a. ((\<lambda>_. True) and (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) a \<and> True \<and> invs' a \<and> st_tcb_at' simple' rv a \<and> sch_act_sane a \<and> (\<forall>p. rv \<notin> set (ksReadyQueues a p)) \<and> rv = ksCurThread a \<and> valid_objs' a))) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (2 subgoals):
 1. \<And>thread. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1452 (from_bool isBlocking) thread) \<acute>epCPtr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) {s. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> (\<forall>t. (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv'. ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<longrightarrow> (isEndpointCap rv' \<longrightarrow> (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<longrightarrow> (\<exists>sa. (sa, s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := 0\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>sa. (sa, s\<lparr>lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := 0, globals := globals s\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr_' s, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (epCPtr_' s) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))) \<and> (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) \<noteq> 0 \<longrightarrow> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread) \<and> cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<and> (\<not> isEndpointCap rv' \<longrightarrow> (isNotificationCap rv' \<longrightarrow> ((\<exists>v sa. (sa, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' sa) \<longrightarrow> (capNtfnCanReceive rv' \<longrightarrow> (\<forall>ntfn. (\<exists>sa. (sa, s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa) \<longrightarrow> ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)) \<and> (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<longrightarrow> (\<exists>sa. (sa, s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := 0\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>sa. (sa, s\<lparr>lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := 0, globals := globals s\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr_' s, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (epCPtr_' s) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))) \<and> (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) \<noteq> 0 \<and> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) \<noteq> ksCurThread_' (globals s) \<longrightarrow> (\<exists>sa. (sa, s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>sa. (sa, s\<lparr>lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))), globals := globals s\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr_' s, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (epCPtr_' s) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))) \<and> (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) \<noteq> 0 \<and> (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) = 0 \<or> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) = ksCurThread_' (globals s)) \<longrightarrow> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> ((\<exists>sa. (sa, s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>sa. (sa, s\<lparr>lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))), globals := globals s\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr_' s, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (epCPtr_' s) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))) \<and> (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<or> ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) \<noteq> 0 \<and> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) \<noteq> ksCurThread_' (globals s))) \<and> cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> s \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) \<and> cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> isNotificationCap rv' \<longrightarrow> (\<exists>sa. (sa, s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>sa. (sa, s\<lparr>lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)), globals := globals s\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr_' s, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (epCPtr_' s) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread)))))) \<and> (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>ft. (\<exists>w. ft = Fault_H.fault.CapFault (epCPtr_' s) True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t)) (errstate (s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>\<rparr>))) \<longrightarrow> (\<exists>sa. (sa, s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = epCPtr_' s, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (current_lookup_fault_' (globals t))) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread))))}
 2. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>a. invs' a \<and> tcb_at' rv a) and (\<lambda>a. ((\<lambda>_. True) and (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) a \<and> True \<and> invs' a \<and> st_tcb_at' simple' rv a \<and> sch_act_sane a \<and> (\<forall>p. rv \<notin> set (ksReadyQueues a p)) \<and> rv = ksCurThread a \<and> valid_objs' a))) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> ?R'1452 isBlockinga rv} proof (prove)
goal (1 subgoal):
 1. \<And>isBlockinga s s'. \<lbrakk>isBlockinga = from_bool isBlocking; (s, s') \<in> rf_sr; invs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))); s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>a. invs' a \<and> tcb_at' rv a) and (\<lambda>a. ((\<lambda>_. True) and (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True))) a \<and> True \<and> invs' a \<and> st_tcb_at' simple' rv a \<and> sch_act_sane a \<and> (\<forall>p. rv \<notin> set (ksReadyQueues a p)) \<and> rv = ksCurThread a \<and> valid_objs' a))) s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister < SCAST(32 signed \<rightarrow> 32) 0x14 \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> (\<forall>t. (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv'. ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<longrightarrow> (isEndpointCap rv' \<longrightarrow> (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<longrightarrow> (\<exists>sa. (sa, s\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := 0\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>sa. (sa, s\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := 0, globals := globals s\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv))) \<and> (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) \<noteq> 0 \<longrightarrow> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv) \<and> cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<and> (\<not> isEndpointCap rv' \<longrightarrow> (isNotificationCap rv' \<longrightarrow> ((\<exists>v sa. (sa, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' sa) \<longrightarrow> (capNtfnCanReceive rv' \<longrightarrow> (\<forall>ntfn. (\<exists>sa. (sa, s\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') sa) \<longrightarrow> ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)) \<and> (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<longrightarrow> (\<exists>sa. (sa, s\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := 0\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>sa. (sa, s\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := 0, globals := globals s\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv))) \<and> (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) \<noteq> 0 \<and> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) \<noteq> ksCurThread_' (globals s) \<longrightarrow> (\<exists>sa. (sa, s\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>sa. (sa, s\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))), globals := globals s\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv))) \<and> (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) \<noteq> 0 \<and> (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) = 0 \<or> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) = ksCurThread_' (globals s)) \<longrightarrow> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv))) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> ((\<exists>sa. (sa, s\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>sa. (sa, s\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))), globals := globals s\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv))) \<and> (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<or> ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) \<noteq> 0 \<and> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) \<noteq> ksCurThread_' (globals s))) \<and> cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> s \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) \<and> cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> isNotificationCap rv' \<longrightarrow> (\<exists>sa. (sa, s\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>sa. (sa, s\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)), globals := globals s\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv)))))) \<and> (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>ft. (\<exists>w. ft = Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)]) True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t)) (errstate (s\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>\<rparr>))) \<longrightarrow> (\<exists>sa. (sa, s\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (current_lookup_fault_' (globals t))) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv))))}} proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))\<rbrakk> \<Longrightarrow> tcb_at' (ksCurThread s) s \<and> sch_act_not (ksCurThread s) s \<and> valid_objs' s \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister = register_from_H Thread_H.capRegister \<and> (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister < 0x14 \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv \<longrightarrow> (\<forall>t. (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv'. ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<longrightarrow> (isEndpointCap rv' \<longrightarrow> (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := 0\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := 0, globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))))) \<and> cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<and> (\<not> isEndpointCap rv' \<longrightarrow> (isNotificationCap rv' \<longrightarrow> ((\<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s) \<longrightarrow> (capNtfnCanReceive rv' \<longrightarrow> (\<forall>ntfn. (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') s) \<longrightarrow> ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)) \<and> (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := 0\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := 0, globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))))) \<and> (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) \<noteq> 0 \<and> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) \<noteq> tcb_ptr_to_ctcb_ptr rv \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))))))) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> ((\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))))) \<and> (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<or> ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) \<noteq> 0 \<and> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) \<noteq> tcb_ptr_to_ctcb_ptr rv)) \<and> cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> s' \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) \<and> cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> isNotificationCap rv' \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta)))))))) \<and> (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>ft. (\<exists>w. ft = Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)]) True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t)) (errstate (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>\<rparr>))) \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (current_lookup_fault_' (globals t))))))))) proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))\<rbrakk> \<Longrightarrow> tcb_at' (ksCurThread s) s \<and> sch_act_not (ksCurThread s) s \<and> valid_objs' s \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister = register_from_H Thread_H.capRegister \<and> (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister < 0x14 \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv \<longrightarrow> (\<forall>t. (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv'. ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<longrightarrow> (cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := 0\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := 0, globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))))) \<and> (cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (\<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s) \<longrightarrow> (capNtfnCanReceive rv' \<longrightarrow> (\<forall>ntfn. (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') s) \<longrightarrow> ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)) \<and> (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := 0\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := 0, globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))))) \<and> (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) \<noteq> 0 \<and> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) \<noteq> tcb_ptr_to_ctcb_ptr rv \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))))))) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> ((\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))))) \<and> (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<or> ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) \<noteq> 0 \<and> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) \<noteq> tcb_ptr_to_ctcb_ptr rv)) \<and> s' \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) \<and> (cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta)))))))) \<and> (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>ft. (\<exists>w. ft = Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)]) True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t)) (errstate (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>\<rparr>))) \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister)], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (current_lookup_fault_' (globals t))))))))) proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))\<rbrakk> \<Longrightarrow> sch_act_not (ksCurThread s) s \<and> valid_objs' s \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv \<longrightarrow> (\<forall>t. (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv'. ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<longrightarrow> (cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := 0\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := 0, globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))))) \<and> (cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (\<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s) \<longrightarrow> (capNtfnCanReceive rv' \<longrightarrow> (\<forall>ntfn. (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') s) \<longrightarrow> ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)) \<and> (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := 0\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := 0, globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))))) \<and> (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) \<noteq> 0 \<and> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) \<noteq> tcb_ptr_to_ctcb_ptr rv \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))))))) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> ((\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))))) \<and> (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<or> ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) \<noteq> 0 \<and> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) \<noteq> tcb_ptr_to_ctcb_ptr rv)) \<and> s' \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) \<and> (cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta)))))))) \<and> (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>ft. (\<exists>w. ft = Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t)) (errstate (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>\<rparr>))) \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (current_lookup_fault_' (globals t)))))))) proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s\<rbrakk> \<Longrightarrow> sch_act_not (ksCurThread s) s \<and> valid_objs' s \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv \<longrightarrow> (\<forall>t. (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv'. ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<longrightarrow> (cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := 0\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := 0, globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))))) \<and> (cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (\<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s) \<longrightarrow> (capNtfnCanReceive rv' \<longrightarrow> (\<forall>ntfn. (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') s) \<longrightarrow> ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)) \<and> (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := 0\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := 0, globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))))) \<and> (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) \<noteq> 0 \<and> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) \<noteq> tcb_ptr_to_ctcb_ptr rv \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))))))) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> ((\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))))) \<and> (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<or> ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) \<noteq> 0 \<and> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) \<noteq> tcb_ptr_to_ctcb_ptr rv)) \<and> s' \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) \<and> (cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta)))))))) \<and> (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>ft. (\<exists>w. ft = Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t)) (errstate (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>\<rparr>))) \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (current_lookup_fault_' (globals t)))))))) proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits\<rbrakk> \<Longrightarrow> sch_act_not (ksCurThread s) s \<and> valid_objs' s \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv \<longrightarrow> (\<forall>t. (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv'. ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<longrightarrow> (cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := 0\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := 0, globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))))) \<and> (cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (\<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s) \<longrightarrow> (capNtfnCanReceive rv' \<longrightarrow> (\<forall>ntfn. (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') s) \<longrightarrow> ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)) \<and> (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := 0\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := 0, globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))))) \<and> (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) \<noteq> 0 \<and> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) \<noteq> tcb_ptr_to_ctcb_ptr rv \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))))))) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> ((\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))))) \<and> (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<or> ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) \<noteq> 0 \<and> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) \<noteq> tcb_ptr_to_ctcb_ptr rv)) \<and> s' \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) \<and> (cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta)))))))) \<and> (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>ft. (\<exists>w. ft = Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t)) (errstate (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>\<rparr>))) \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (current_lookup_fault_' (globals t)))))))) proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits\<rbrakk> \<Longrightarrow> sch_act_not (ksCurThread s) s \<and> (\<forall>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv \<longrightarrow> (\<forall>t. (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv'. ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<longrightarrow> (cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := 0\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := 0, globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))))) \<and> (cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (\<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s) \<longrightarrow> (capNtfnCanReceive rv' \<longrightarrow> (\<forall>ntfn. (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') s) \<longrightarrow> ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn)) \<and> (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := 0\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := 0, globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))))) \<and> (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) \<noteq> 0 \<and> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) \<noteq> tcb_ptr_to_ctcb_ptr rv \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))))))) \<and> (\<not> capNtfnCanReceive rv' \<longrightarrow> ((\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))))) \<and> (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<or> ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) \<noteq> 0 \<and> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) \<noteq> tcb_ptr_to_ctcb_ptr rv)) \<and> s' \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) \<and> (cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta)))))))) \<and> (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>ft. (\<exists>w. ft = Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t)) (errstate (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>\<rparr>))) \<longrightarrow> (\<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>ta. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (current_lookup_fault_' (globals t)))))))) proof (prove)
goal (10 subgoals):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits\<rbrakk> \<Longrightarrow> sch_act_not (ksCurThread s) s
 2. \<And>s s' rv t rv' ta tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := 0\<rparr>) \<in> rf_sr; lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := 0, globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))
 3. \<And>s s' rv t rv' ntfn. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s; capNtfnCanReceive rv'; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') s\<rbrakk> \<Longrightarrow> ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))
 4. \<And>s s' rv t rv' ntfn ta tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s; capNtfnCanReceive rv'; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') s; capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := 0\<rparr>) \<in> rf_sr; lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := 0, globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))
 5. \<And>s s' rv t rv' ntfn ta tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s; capNtfnCanReceive rv'; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') s; ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) \<noteq> 0 \<and> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) \<noteq> tcb_ptr_to_ctcb_ptr rv; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr; lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))
 6. \<And>s s' rv t rv' ta tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s; \<not> capNtfnCanReceive rv'; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr; lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))
 7. \<And>s s' rv t rv'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s; \<not> capNtfnCanReceive rv'\<rbrakk> \<Longrightarrow> capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<or> ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) \<noteq> 0 \<and> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) \<noteq> tcb_ptr_to_ctcb_ptr rv
 8. \<And>s s' rv t rv'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))
 9. \<And>s s' rv t rv' ta tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))\<rparr>) \<in> rf_sr; lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))
 10. \<And>s s' rv t ft ta. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. ft = Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t)) (errstate (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>\<rparr>)); \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (current_lookup_fault_' (globals t))) proof (prove)
goal (8 subgoals):
 1. \<And>s s' rv t rv' ntfn v sa sb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_notification_cap \<noteq> cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; capNtfnCanReceive rv'; (sa, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr; ko_at' ntfn (capNtfnPtr rv') sa; (sb, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr; valid_cap' rv' sb\<rbrakk> \<Longrightarrow> ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))
 2. \<And>s s' rv t rv' ntfn ta tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s; capNtfnCanReceive rv'; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') s; capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := 0\<rparr>) \<in> rf_sr; lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := 0, globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))
 3. \<And>s s' rv t rv' ntfn ta tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s; capNtfnCanReceive rv'; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') s; ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) \<noteq> 0 \<and> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) \<noteq> tcb_ptr_to_ctcb_ptr rv; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr; lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))
 4. \<And>s s' rv t rv' ta tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s; \<not> capNtfnCanReceive rv'; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr; lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))
 5. \<And>s s' rv t rv'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s; \<not> capNtfnCanReceive rv'\<rbrakk> \<Longrightarrow> capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<or> ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) \<noteq> 0 \<and> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) \<noteq> tcb_ptr_to_ctcb_ptr rv
 6. \<And>s s' rv t rv'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))
 7. \<And>s s' rv t rv' ta tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))\<rparr>) \<in> rf_sr; lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))
 8. \<And>s s' rv t ft ta. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. ft = Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t)) (errstate (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>\<rparr>)); \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (current_lookup_fault_' (globals t))) proof (prove)
goal (8 subgoals):
 1. \<And>s s' rv t ntfn v sa sb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))) (capNtfnBadge_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) True) (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_notification_cap \<noteq> cap_endpoint_cap; to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))); (sa, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr; ko_at' ntfn (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))) sa; (sb, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr; valid_cap' (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))) (capNtfnBadge_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) True) sb\<rbrakk> \<Longrightarrow> ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))
 2. \<And>s s' rv t rv' ntfn ta tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s; capNtfnCanReceive rv'; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') s; capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := 0\<rparr>) \<in> rf_sr; lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := 0, globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))
 3. \<And>s s' rv t rv' ntfn ta tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s; capNtfnCanReceive rv'; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') s; ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) \<noteq> 0 \<and> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) \<noteq> tcb_ptr_to_ctcb_ptr rv; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr; lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))
 4. \<And>s s' rv t rv' ta tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s; \<not> capNtfnCanReceive rv'; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr; lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))
 5. \<And>s s' rv t rv'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s; \<not> capNtfnCanReceive rv'\<rbrakk> \<Longrightarrow> capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<or> ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) \<noteq> 0 \<and> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) \<noteq> tcb_ptr_to_ctcb_ptr rv
 6. \<And>s s' rv t rv'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))
 7. \<And>s s' rv t rv' ta tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))\<rparr>) \<in> rf_sr; lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))
 8. \<And>s s' rv t ft ta. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. ft = Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t)) (errstate (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>\<rparr>)); \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (current_lookup_fault_' (globals t))) proof (prove)
goal (8 subgoals):
 1. \<And>s s' rv t ntfn v sa sb y'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))) (capNtfnBadge_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) True) (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_notification_cap \<noteq> cap_endpoint_cap; to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))); (sa, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr; ko_at' ntfn (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))) sa; (sb, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr; valid_cap' (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))) (capNtfnBadge_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) True) sb; map_to_ntfns (ksPSpace sa) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))) = Some ntfn; cnotification_relation (cslift (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) ntfn y'; cslift (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) = Some y'\<rbrakk> \<Longrightarrow> ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) = ptr_val (option_to_ctcb_ptr (ntfnBoundTCB ntfn))
 2. \<And>s s' rv t rv' ntfn ta tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s; capNtfnCanReceive rv'; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') s; capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := 0\<rparr>) \<in> rf_sr; lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := 0, globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))
 3. \<And>s s' rv t rv' ntfn ta tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s; capNtfnCanReceive rv'; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') s; ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) \<noteq> 0 \<and> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) \<noteq> tcb_ptr_to_ctcb_ptr rv; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr; lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))
 4. \<And>s s' rv t rv' ta tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s; \<not> capNtfnCanReceive rv'; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr; lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))
 5. \<And>s s' rv t rv'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s; \<not> capNtfnCanReceive rv'\<rbrakk> \<Longrightarrow> capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<or> ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) \<noteq> 0 \<and> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) \<noteq> tcb_ptr_to_ctcb_ptr rv
 6. \<And>s s' rv t rv'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))
 7. \<And>s s' rv t rv' ta tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))\<rparr>) \<in> rf_sr; lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))
 8. \<And>s s' rv t ft ta. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. ft = Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t)) (errstate (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>\<rparr>)); \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (current_lookup_fault_' (globals t))) proof (prove)
goal (7 subgoals):
 1. \<And>s s' rv t rv' ntfn ta tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s; capNtfnCanReceive rv'; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') s; capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := 0\<rparr>) \<in> rf_sr; lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := 0, globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))
 2. \<And>s s' rv t rv' ntfn ta tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s; capNtfnCanReceive rv'; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr \<and> ko_at' ntfn (capNtfnPtr rv') s; ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) \<noteq> 0 \<and> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) \<noteq> tcb_ptr_to_ctcb_ptr rv; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr; lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))
 3. \<And>s s' rv t rv' ta tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s; \<not> capNtfnCanReceive rv'; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>) \<in> rf_sr; lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ntfnPtr_' := ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))), boundTCB_' := tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))), ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))
 4. \<And>s s' rv t rv'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s; \<not> capNtfnCanReceive rv'\<rbrakk> \<Longrightarrow> capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<or> ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) \<noteq> 0 \<and> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) \<noteq> tcb_ptr_to_ctcb_ptr rv
 5. \<And>s s' rv t rv'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))
 6. \<And>s s' rv t rv' ta tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))\<rparr>) \<in> rf_sr; lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))
 7. \<And>s s' rv t ft ta. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. ft = Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t)) (errstate (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>\<rparr>)); \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (current_lookup_fault_' (globals t))) proof (prove)
goal (4 subgoals):
 1. \<And>s s' rv t rv' v sa. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_notification_cap \<noteq> cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<not> capNtfnCanReceive rv'; (sa, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr; valid_cap' rv' sa; ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) = 0 \<or> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) = tcb_ptr_to_ctcb_ptr rv\<rbrakk> \<Longrightarrow> capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0
 2. \<And>s s' rv t rv'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))
 3. \<And>s s' rv t rv' ta tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))\<rparr>) \<in> rf_sr; lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))
 4. \<And>s s' rv t ft ta. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. ft = Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t)) (errstate (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>\<rparr>)); \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (current_lookup_fault_' (globals t))) proof (prove)
goal (4 subgoals):
 1. \<And>s s' rv t v sa. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))) (capNtfnBadge_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) False) (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_notification_cap \<noteq> cap_endpoint_cap; \<not> to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))); (sa, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr; valid_cap' (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))) (capNtfnBadge_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) False) sa; ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))))) = 0 \<or> tcb_Ptr (ntfnBoundTCB_CL (notification_lift (the (cslift s' (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))))))) = tcb_ptr_to_ctcb_ptr rv\<rbrakk> \<Longrightarrow> capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0
 2. \<And>s s' rv t rv'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))
 3. \<And>s s' rv t rv' ta tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))\<rparr>) \<in> rf_sr; lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))
 4. \<And>s s' rv t ft ta. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. ft = Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t)) (errstate (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>\<rparr>)); \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (current_lookup_fault_' (globals t))) proof (prove)
goal (3 subgoals):
 1. \<And>s s' rv t rv'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>v s. (s, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr \<and> valid_cap' rv' s\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))
 2. \<And>s s' rv t rv' ta tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))\<rparr>) \<in> rf_sr; lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))
 3. \<And>s s' rv t ft ta. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. ft = Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t)) (errstate (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>\<rparr>)); \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (current_lookup_fault_' (globals t))) proof (prove)
goal (3 subgoals):
 1. \<And>s s' rv t v sa. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))) (capNtfnBadge_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))) (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_notification_cap \<noteq> cap_endpoint_cap; (sa, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr; capAligned (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))) (capNtfnBadge_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))); ntfn_at' (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))) sa\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))
 2. \<And>s s' rv t rv' ta tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))\<rparr>) \<in> rf_sr; lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))
 3. \<And>s s' rv t ft ta. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. ft = Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t)) (errstate (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>\<rparr>)); \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (current_lookup_fault_' (globals t))) proof (prove)
goal (3 subgoals):
 1. \<And>s s' rv t v sa ko. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))) (capNtfnBadge_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))) (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_notification_cap \<noteq> cap_endpoint_cap; (sa, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr; capAligned (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))) (capNtfnBadge_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))); ko_at' ko (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))) sa\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))
 2. \<And>s s' rv t rv' ta tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))\<rparr>) \<in> rf_sr; lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))
 3. \<And>s s' rv t ft ta. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. ft = Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t)) (errstate (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>\<rparr>)); \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (current_lookup_fault_' (globals t))) proof (prove)
goal (3 subgoals):
 1. \<And>s s' rv t v sa ko y'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))) (capNtfnBadge_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))) (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_notification_cap \<noteq> cap_endpoint_cap; (sa, ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) \<in> rf_sr; capAligned (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))) (capNtfnBadge_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))))); ko_at' ko (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))) sa; map_to_ntfns (ksPSpace sa) (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))) = Some ko; cnotification_relation (cslift (ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>))) ko y'; cslift (ntfnPtr_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, boundTCB_' := v, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)))\<rparr>)) (ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))) = Some y'\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))))
 2. \<And>s s' rv t rv' ta tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))\<rparr>) \<in> rf_sr; lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))
 3. \<And>s s' rv t ft ta. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. ft = Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t)) (errstate (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>\<rparr>)); \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (current_lookup_fault_' (globals t))) proof (prove)
goal (2 subgoals):
 1. \<And>s s' rv t rv' ta tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ccap_relation rv' (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)); cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))\<rparr>) \<in> rf_sr; lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t, ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)), globals := globals s'\<lparr>ghost'state_' := ghost'state_' (globals t), current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True (Fault_H.lookup_failure.MissingCapability 0))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (ret__struct_lookup_fault_C_' ta))
 2. \<And>s s' rv t ft ta. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. ft = Fault_H.fault.CapFault (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0]) True w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t)) (errstate (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>\<rparr>)); \<exists>s. (s, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta)) (lookup_fault_lift (current_lookup_fault_' (globals t))) proof (prove)
goal (1 subgoal):
 1. \<And>s s' rv t ta w sa. \<lbrakk>(s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' (ksCurThread s) s; \<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> t \<noteq> ksCurThread s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); valid_objs' s; is_aligned (ksCurThread s) tcbBlockSizeBits; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr rv; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (sa, s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' ta) = \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr>; seL4_Fault_lift (ret__struct_seL4_Fault_C_' ta) = Some (SeL4_Fault_CapFault \<lparr>seL4_Fault_CapFault_CL.address_CL = h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) true\<rparr>); lookup_failure_rel w (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t)) (errstate (s'\<lparr>epCPtr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[0], globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>\<rparr>))\<rbrakk> \<Longrightarrow> \<exists>lf'. lookup_fault_lift (current_lookup_fault_' (globals t)) = Some lf' \<and> lookup_fault_to_H lf' = w proof (prove)
goal:
No subgoals!